fb-login3shrii[.]vercel[.]app

This domain, fb-login3shrii.vercel.app, is flagged as a high-risk brand impersonation threat specifically targeting Facebook users. Analysis indicates the site mimics legitimate Facebook login pages, aiming to harvest user credentials through deceptive authentication interfaces. The threat type is classified as credential theft via brand impersonation, a common vector for account compromise and subsequent unauthorized access to personal data or financial information. Infrastructure analysis reveals the domain resolves to the IP address 64.29.17.3, associated with Vercel, Inc. in the United States. The domain was registered through Vercel, with an anomalous creation date of May 19, 2026, suggesting potential timestamp manipulation or misconfiguration. Detection metrics show 19 out of 95 security vendors on VirusTotal have flagged this domain as malicious. It appears on one security blocklist, specifically PhishDestroy, and is actively marked as phishing by Google Safe Browsing. The SSL certificate is issued by Google Trust Services (WR1), which, while legitimate, does not mitigate the inherent risk posed by the domain's fraudulent intent. Mitigation against this threat requires immediate action from both end-users and network administrators. Users should avoid interacting with fb-login3shrii.vercel.app and any similar domains, particularly those mimicking Facebook’s branding. Network-level protections should include blocking the domain and its resolving IP (64.29.17.3) at firewalls or DNS filtering systems. Organizations are advised to monitor for credential reuse attempts, as harvested credentials may be exploited across multiple platforms. Additionally, security teams should investigate logs for connections to the domain or IP to identify potentially compromised accounts. User education on recognizing brand impersonation tactics, such as scrutinizing URLs and verifying SSL certificate details, remains critical in preventing credential theft.