facebook[.]redirect[.]securelogin[.]ovh

The domain facebook.redirect.securelogin.ovh was registered on October 15 2025 through OVH and is currently listed as active. It is classified as a high‑risk brand‑impersonation campaign targeting Facebook, as indicated by the page title “Facebook – log in or sign up”. The site returns an HTTP 308 status, which confirms that it performs a permanent redirect rather than serving content directly.

Infrastructure analysis shows the domain resolves to IP 91.179.180.220, located in Belgium and announced by AS5432 (Proximus NV). No SSL certificate is present, meaning the connection is unencrypted. Authoritative name servers are dns16.ovh.net and ns16.ovh.net, both belonging to the OVH hosting provider. The absence of HTTPS and the use of a 308 redirect are typical of credential‑harvesting infrastructure that forwards victims to a malicious endpoint.

Reputation data indicates a Gridinsoft trust score of 0 / 100 and detection by two public blocklists (PhishDestroy and PhishingDB). VirusTotal reports that 17 out of 95 scanned security vendors flag the domain, reinforcing the high‑risk assessment. The domain appears on two blocklists, confirming that multiple threat‑intel feeds have observed malicious activity associated with this host.

While the current intelligence confirms the domain’s impersonation of Facebook and its active status, the exact payload delivered after the redirect has not been disclosed. Defenders should block the domain at perimeter firewalls and DNS resolvers, monitor outbound connections to 91.179.180.220, and enforce HTTPS‑only policies to prevent accidental credential submission. Continuous telemetry collection from endpoint agents can aid in detecting any subsequent malicious payloads that may be delivered after the redirect.