facebook-clone-neon-ten[.]vercel[.]app

The domain facebook-clone-neon-ten.vercel.app is currently active and classified as a brand impersonation threat specifically targeting Facebook. Infrastructure analysis reveals the page title mimics the legitimate Facebook login portal, displaying 'Facebook - log in or sign up' to deceive users into submitting credentials. This domain poses a high-risk phishing threat due to its active status and targeted deception of a major social media platform. Technical indicators confirm the domain's malicious nature. The domain was created on January 28, 2020, and is registered through Vercel Inc. It resolves to the IP address 64.29.17.67. Security vendor analysis on VirusTotal shows 25 of 95 engines flagging the domain as malicious. The domain appears on one security blocklist, and Google Safe Browsing has explicitly marked it as phishing. The SSL certificate is issued by Google Trust Services under the identifier WR1, which does not mitigate the threat due to the domain's fraudulent intent. Current status indicates the domain remains operational, continuing to present a significant risk to users. Organizations and individuals are advised to block this domain at the network level and update endpoint protection rules to include this indicator of compromise. Users who may have interacted with this domain should immediately reset their credentials via the legitimate Facebook platform and enable multi-factor authentication. Security teams should monitor for related domains registered through Vercel Inc. or resolving to the same IP infrastructure, as these may represent additional threats from the same actor.