facebook-sage-tau.vercel.app

Facebook

https://facebook-sage-tau.vercel.app Access site

Screenshot

Investigate

Domain facebook-sage-tau.vercel.app0 CT hosts on apex

urlscan

page.domain

VirusTotal

Whois

IP 64.29.17.67

urlscan

page.ip

VirusTotal

ipinfo

Greynoise

URL https://facebook-sage-tau.vercel.app

urlscan

Wayback

archive.today

Cert WR1

crt.sh

Censys

Google CT

Phishunt analysis Beta

39 medium suspicion suspiciousheuristic risk score · not a probability

Why?

+6.1 Google Safe Browsing
+5.3 Keyword match
+5.1 Site cluster
+3.9 Password field
+3.7 Brand in domain label
+3.4 Cert reuse
+3.4 Shared IP cluster
+3.0 OpenPhish
+1.1 ASN reputation
+1.1 No CSP header
+0.6 Long domain
+0.6 Login text in screenshot
+0.6 Suspicious TLD
+0.5 Young certificate
+0.4 Obfuscated JavaScript
+0.3 Free CA
+0.2 Hyphens
+0.1 Deep subdomain

21 signals fired · detector v3.0.0

AI analysis AIBeta

Credential harvesting

Impersonates Facebook on a Vercel free hosting subdomain to harvest credentials. The brand name is embedded in the domain label, JavaScript is obfuscated to hinder analysis, and the site is confirmed malicious by both Google Safe Browsing and OpenPhish.

Brand in domain labelObfuscated JavaScriptGoogle Safe Browsing

AI-generated from stored detector signals - the AI never visited the site. · 2026-09-18 · confidence 85%

Domain & Network

Whois

Registrar Tucows Domains Inc

Network

IP 64.29.17.67

Country