facebook-clone-pi[.]vercel[.]app

This domain, facebook-clone-pi.vercel.app, is flagged for brand impersonation targeting Facebook. Analysis indicates it operates as a credential phishing site, presenting a fraudulent login interface under the page title 'Facebook' to deceive users into submitting account credentials. No drainer kit signatures were identified in initial scans, but the domain exhibits classic phishing infrastructure characteristics. Infrastructure analysis reveals the domain was registered through Vercel and resolves to IP address 64.29.17.131, located in the US under Vercel, Inc. The SSL certificate is issued by Google Trust Services (WR1). VirusTotal detection shows 20 out of 95 security vendors flagging the domain as malicious. The domain was created on May 09, 2026, though this date may reflect registry manipulation. It appears on one security blocklist and is currently blocked by at least one threat intelligence feed. The domain remains active as of this report, posing an ongoing risk to users. Response actions should include immediate blacklisting in enterprise security controls, DNS sinkholing, and user awareness campaigns targeting Facebook phishing threats. Despite detection by multiple vendors, the domain’s hosting on a legitimate platform (Vercel) may delay takedown, prolonging exposure. Organizations are advised to monitor for credential reuse attempts from harvested data and implement multi-factor authentication to mitigate account compromise risks.