navvurem-biz-zarkequla-22t526sd[.]netlify[.]app

This domain is a credential-harvesting phishing site designed to impersonate Facebook’s login page. Visitors are presented with a fraudulent interface titled 'Facebook – log in or sign up,' which captures entered usernames, passwords, and potentially two-factor authentication codes. The site’s infrastructure is engineered to deceive users into believing they are accessing a legitimate Facebook portal, enabling attackers to hijack accounts for malicious purposes such as spam distribution, financial fraud, or further phishing campaigns targeting connected contacts. Analysis indicates the domain is hosted on Netlify infrastructure and resolves to the IP address 31.13.84.36, associated with AS16509 (Amazon.com, Inc.) in Germany. The SSL certificate, issued by DigiCert Inc (DigiCert Global G2 TLS RSA SHA256 2020 CA1), provides a false sense of security while the site remains active. VirusTotal reports 14 out of 95 security vendors have flagged this domain as malicious, and it appears on at least one security blocklist. The domain’s registration details obscure ownership, a common tactic in phishing operations to evade takedown efforts. If a user has interacted with this domain, immediate action is required to mitigate risk. First, change the password for the affected Facebook account and any other platforms where the same credentials were reused. Enable two-factor authentication using an app-based method rather than SMS. Review the account for unauthorized activity, including posts, messages, or connected applications, and revoke access to any unfamiliar third-party services. Monitor linked email accounts for suspicious login attempts or password reset requests. If financial or personal data was entered, consider placing a fraud alert on credit reports and reporting the incident to relevant cybersecurity authorities. Users should also scan their devices for malware, as phishing sites may deploy additional payloads.