curly-spoon-sigma[.]vercel[.]app

This domain, curly-spoon-sigma.vercel.app, poses a high-risk credential theft threat by impersonating Facebook login pages. Visitors are presented with a fraudulent interface designed to harvest account credentials, including usernames, passwords, and potentially two-factor authentication codes. The page title, 'Naver Sign in,' further obfuscates its true intent, attempting to mislead users into believing they are interacting with a legitimate service. Such attacks can lead to unauthorized account access, data breaches, and subsequent exploitation for further malicious activities, including financial fraud or identity theft. Analysis indicates the domain is hosted on infrastructure resolving to the IP address 64.29.17.195, located in the United States under Amazon.com, Inc.'s AS16509. The SSL certificate is issued by Google Trust Services, a common tactic to lend false legitimacy. The domain was registered through Tucows Domains Inc. on February 21, 2026, an unusually forward-dated registration that may indicate an attempt to evade detection or extend operational longevity. Security vendor assessments on VirusTotal reveal that 20 out of 95 engines flag the domain as malicious, while it appears on one additional security blocklist. The discrepancy between the page title and the targeted brand suggests an attempt to bypass automated detection systems. Individuals who have visited curly-spoon-sigma.vercel.app or entered credentials on the site should immediately take corrective action. First, change the password for the targeted Facebook account and any other platforms where the same credentials may have been reused. Enable multi-factor authentication if not already active, using an authenticator app rather than SMS-based methods where possible. Monitor the account for unauthorized activity, such as unrecognized logins, messages sent, or changes to profile information. If financial or personal data was exposed, consider placing a fraud alert or credit freeze with relevant bureaus. Report the incident to the targeted brand's security team and local cybercrime authorities to aid in tracking and mitigating the campaign.