m[.]imajbetoriginal[.]vip

This domain is flagged as an elevated-risk credential harvesting infrastructure targeting Facebook users. Analysis indicates the threat type is brand impersonation with a specific focus on stealing login credentials through a fraudulent Facebook login page titled 'Facebook - Giriş Yap veya Kaydol.' The domain currently appears offline, but prior activity and infrastructure details warrant continued monitoring and mitigation. Infrastructure analysis reveals the following technical indicators: the domain m.imajbetoriginal.vip was registered through Dynadot LLC and resolves to the IP address 130.12.182.95, hosted on AS36680 (Netiface LLC) in Germany. The domain was created on March 14, 2026, and is flagged by 21 out of 95 security vendors on VirusTotal. It appears on at least one security blocklist and is actively blocked by enterprise threat intelligence feeds. The page title and structure closely mimic Facebook’s legitimate login portal, increasing the likelihood of successful deception. Organizations and end-users should implement the following mitigation steps to counter this specific threat type. Network-level blocking of the domain m.imajbetoriginal.vip and its associated IP 130.12.182.95 is recommended to prevent access. Security teams should update endpoint protection rules to detect and block similar brand impersonation attempts, particularly those mimicking login pages. User awareness training should emphasize verifying domain authenticity before entering credentials, especially for high-value targets like social media platforms. Monitoring for newly registered domains with similar naming patterns (e.g., 'imajbet,' 'original') can help identify related threats early.