facebook-clone-login[.]vercel[.]app

The domain facebook-clone-login.vercel.app is currently active and classified as a high‑risk brand‑impersonation site targeting Facebook users. Registration data shows the domain was created on April 19 2026 and provisioned through Vercel Inc., with DNS resolution to IP address 216.198.79.195 located in the United States, consistent with Vercel’s hosting infrastructure. The site serves content over HTTPS using a Google Trust Services / WR1 certificate and enforces HSTS, returning HTTP 200 for the root request. The page title returned by the server is "Facebook - log in or sign up," matching the declared brand target of Facebook. Independent reputation services assign extremely low trust scores: Gridinsoft reports 0 / 100, Scamadviser 1 / 100, and Google Safe Browsing flags the URL for SOCIAL_ENGINEERING. VirusTotal analysis shows 21 of 94 security vendors flag the domain, and the site is listed on at least one public blocklist, with PhishDestroy already blocking it. While the technical footprint confirms Vercel hosting and a valid TLS certificate, the low trust metrics and social‑engineering classification indicate a credential‑phishing operation. Defenders should add the domain to network and email filtering rules, monitor DNS queries for the associated IP, and educate users about unsolicited login prompts referencing Facebook. Further investigation is needed to capture any payloads or credential harvesting mechanisms, as the current evidence is limited to infrastructure and reputation data.