ssteal[.]com

The domain ssteal.com is a confirmed phishing site engaged in brand impersonation targeting Facebook users. It presents itself as a legitimate Facebook login portal to deceive victims into entering credentials, constituting a social media phishing scam. No crypto drainer kit was identified. The site is currently taken offline, but prior activity poses an elevated risk to users who may have interacted with it.

Technical analysis shows ssteal.com was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). Google Safe Browsing did not flag the domain. It was registered through Squarespace Domains LLC on April 04, 2025, and resolved to IP address 76.76.21.61, hosted on Amazon.com, Inc. infrastructure (AS16509) in the US. The SSL certificate was issued by Let's Encrypt (R12), and the observed page title was 'SSTEAL'. Technologies detected include Vercel and HSTS, with nameservers pointing to Google Domains (ns-cloud-e2.googledomains.com, ns-cloud-e3.googledomains.com, ns-cloud-e4.googledomains.com). Gridinsoft assigned a trust score of 0/100.

Users who entered credentials on ssteal.com should immediately change their Facebook password and enable two-factor authentication (2FA) to prevent account takeover. Monitor the account for unauthorized activity, such as posts or messages sent without consent. Report the phishing domain to Facebook via their official reporting channels and to the Anti-Phishing Working Group at reportphishing@apwg.org. If financial or personal data was exposed, consider placing a fraud alert with credit bureaus. Avoid interacting with the domain ssteal.com or any links associated with it.