mexswin2b[.]top

The domain mexswin2b.top has been flagged for brand impersonation, specifically targeting Facebook. Analysis indicates that the domain is currently active and has been operational since its creation on December 29, 2024. The domain resolves to the IP address 172.67.145.33, which is hosted by Cloudflare, Inc. (AS13335), a common practice among both legitimate and malicious sites to obscure their true origin. The site's HTTP status is 200, indicating that it is accessible and functioning as intended. Despite the presence of several reputable technologies such as Google Sign-in, reCAPTCHA, and Google Tag Manager, the domain has a very low Gridinsoft trust score of 0/100, suggesting significant risk. The SSL certificate is issued by Google Trust Services, which, while indicating a secure connection, does not necessarily imply that the site is benign. The domain is registered through NameSilo, LLC, a registrar known for its use by both legitimate and malicious actors. Six out of 95 security vendors on VirusTotal have flagged this domain, and it appears on one security blocklist, specifically PhishDestroy. These indicators suggest that the domain is likely part of a social media scam, aiming to deceive users into divulging sensitive information or performing unauthorized actions. While the exact content of the site is not yet analyzed, the presence of technologies like Google Sign-in and reCAPTCHA could be an attempt to lend credibility to the impersonation. Defenders should monitor this domain closely, implement DNS-based blocking, and educate users about the risks of social media impersonation scams. Additionally, regular updates to security filters and threat intelligence feeds are recommended to mitigate the potential impact of such attacks.