Facebook

Social media United Statesfacebook.comRank 5 of the most impersonated
Cert findings · 24 h
7
Cert findings · 7 days
23
9 reported or listed · 14 on phishing hosts
Registered lookalikes
519
64 listed by a source or an address list
Official domains
40
verified from Facebook's own sites and records

Certificate findings for Facebook

Updated hourly · 2026-11-05 10:53 UTC

DomainSpoof matched these hostnames, from public certificate logs, to Facebook's name or to lookalike spellings of its official domains. Each was reported or listed by one of our sources, or resolved to an address on Spamhaus DROP or DomainSpoof's phishing-host list.

Published now · 33 findings, grouped by hostname

  1. campsite.bio US · AS16509 · Amazon.com, Inc.4 addresses
    ReportedAmazon Web ServicesReported by PhishTank as imitating FacebookMX presentSPF -allDMARC rejectRegistered 10 y ago
    DetailsHide
    Hostname
    campsite.bio
    First seen
    2026-11-05 06:21 UTC
    First published
    2026-11-05 07:32 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-05 07:44 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 M01
    Valid 2026-08-25 00:00 UTC to 2027-03-10 23:59 UTC
    Logged 2026-11-05 06:17 UTC in DigiCert Sphinx2027h1, entry 363,730,579
    SHA-256 0f6ca033c05ef5ccd39dff03a50a5d002d4b5b940e95325fcbfb8d8b3341b666
    Public key SHA-256 bb9b34fa536aade3c5e163ad6a2d89033d67f6cfb3b9d565cc268df0e1b4399a
    PhishTank
    PhishTank report #9308104
    Brand
    Facebook
    Addresses
    3.173.161.10 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    3.173.161.57 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    3.173.161.83 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    3.173.161.107 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (3.173.161.10, 3.173.161.57, 3.173.161.83, 3.173.161.107): a cloud provider. It rents servers and addresses to its customers.
    Domain
    campsite.bio
    Registered
    2017-05-04 · NameCheap, Inc.
    MX
    Receives mail at mx.zoho.com, mx2.zoho.com, mx3.zoho.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-05 07:32 UTC

    Suggest a correction

  2. www.facebook-lp.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    www.facebook-lp.de
    First seen
    2026-11-05 01:26 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 00:26 UTC to 2027-02-03 00:26 UTC
    Logged 2026-11-05 01:25 UTC in Let's Encrypt Sycamore2027h1, entry 950,874,227
    SHA-256 7d5d273c37ff5afeea1829beca7167bb917a82796db0679575ad6010ef39ac3a
    Public key SHA-256 9e461d1c96977f09112f56a040bcccb4335ddea55bc2bf4e7846a0c2f2d9ba30
    Brand
    Facebook
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    facebook-lp.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:36 UTC

    Suggest a correction

  3. locadino.facebook-lp.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    locadino.facebook-lp.de
    First seen
    2026-11-05 01:26 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 00:26 UTC to 2027-02-03 00:26 UTC
    Logged 2026-11-05 01:25 UTC in Let's Encrypt Sycamore2027h1, entry 950,874,227
    SHA-256 7d5d273c37ff5afeea1829beca7167bb917a82796db0679575ad6010ef39ac3a
    Public key SHA-256 9e461d1c96977f09112f56a040bcccb4335ddea55bc2bf4e7846a0c2f2d9ba30
    Brand
    Facebook
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    facebook-lp.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:36 UTC

    Suggest a correction

  4. facebook-lp.de DE · AS3320 · DTAG Deutsche Telekom AG
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC missing
    DetailsHide
    Hostname
    facebook-lp.de
    First seen
    2026-11-05 01:26 UTC
    First published
    2026-11-05 01:50 UTC
    DNS
    Resolves · checked 2026-11-05 02:00 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 80.150.6.143.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 80.150.6.143
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-05 00:26 UTC to 2027-02-03 00:26 UTC
    Logged 2026-11-05 01:25 UTC in Let's Encrypt Sycamore2027h1, entry 950,874,227
    SHA-256 7d5d273c37ff5afeea1829beca7167bb917a82796db0679575ad6010ef39ac3a
    Public key SHA-256 9e461d1c96977f09112f56a040bcccb4335ddea55bc2bf4e7846a0c2f2d9ba30
    Brand
    Facebook
    Addresses
    80.150.6.143 · Germany · AS3320 DTAG Deutsche Telekom AG
    Domain
    facebook-lp.de
    MX
    Receives mail at smtp-01.tld.t-online.de, smtp-02.tld.t-online.de
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 01:36 UTC

    Suggest a correction

  5. bio.site US · AS54113 · Fastly, Inc.4 addresses
    ReportedFastlyReported by PhishTank as imitating FacebookMX presentSPF ~allDMARC rejectRegistered 6 y ago
    DetailsHide
    Hostname
    bio.site
    First seen
    2026-11-04 21:21 UTC
    First published
    2026-11-04 22:19 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-04 22:27 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-04 20:18 UTC to 2027-02-02 20:18 UTC
    Logged 2026-11-04 21:16 UTC in Geomys Tuscolo2027h1, entry 477,893,358
    SHA-256 272b8b368efe12922c82f5fd4cd27fb6c1e6c8a4b22480cda23b5ed977b0b490
    Public key SHA-256 b7992811119d8e08793f57e2420d24fb98a923573d60a9e4726ab837f9abffcc
    PhishTank
    PhishTank report #9554007
    Brand
    Facebook
    Addresses
    151.101.2.132 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.66.132 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.130.132 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    151.101.194.132 · United States · AS54113 FASTLY - Fastly, Inc. · Fastly (cdn)
    Fastly
    Fastly (151.101.2.132, 151.101.66.132, 151.101.130.132, 151.101.194.132): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bio.site
    Registered
    2020-07-20 · MarkMonitor Inc.
    MX
    Receives mail at eforward1.registrar-servers.com, eforward2.registrar-servers.com, eforward3.registrar-servers.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 22:19 UTC

    Suggest a correction

  6. www.facebook.com-marketplace-45657784.lefn.cl US · AS397423 · Tier.Net Technologies LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    www.facebook.com-marketplace-45657784.lefn.cl
    First seen
    2026-11-04 13:05 UTC
    First published
    2026-11-04 13:59 UTC
    DNS
    Resolves · checked 2026-11-04 14:20 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 38.18.230.11.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 38.18.230.11
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 11:59 UTC to 2027-02-02 11:59 UTC
    Logged 2026-11-04 12:57 UTC in IPng Networks Gouda2027h1, entry 314,485,936
    SHA-256 18996c2de3ceacde6536df61a25bb8b184cad3aa12003e9c9644459dfb67c82f
    Public key SHA-256 b6bc405c02077408e074f71efa4cd73bbd437b13c37acfb1cbe26553b6965462
    Brand
    Facebook
    Addresses
    38.18.230.11 · United States · AS397423 TIER-NET - Tier.Net Technologies LLC
    Domain
    lefn.cl
    MX
    Receives mail at mail.lefn.cl
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:03 UTC

    Suggest a correction

  7. facebook.com-marketplace-45657784.lefn.cl US · AS397423 · Tier.Net Technologies LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missing
    DetailsHide
    Hostname
    facebook.com-marketplace-45657784.lefn.cl
    First seen
    2026-11-04 13:01 UTC
    First published
    2026-11-04 13:12 UTC
    DNS
    Resolves · checked 2026-11-04 13:32 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 38.18.230.11.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 38.18.230.11
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-11-04 11:59 UTC to 2027-02-02 11:59 UTC
    Logged 2026-11-04 12:57 UTC in IPng Networks Gouda2027h1, entry 314,485,936
    SHA-256 18996c2de3ceacde6536df61a25bb8b184cad3aa12003e9c9644459dfb67c82f
    Public key SHA-256 b6bc405c02077408e074f71efa4cd73bbd437b13c37acfb1cbe26553b6965462
    Brand
    Facebook
    Addresses
    38.18.230.11 · United States · AS397423 TIER-NET - Tier.Net Technologies LLC
    Domain
    lefn.cl
    MX
    Receives mail at mail.lefn.cl
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:03 UTC

    Suggest a correction

  8. facebook-community-standards.com DE · AS47846 · SEDO-AS SEDO GmbH
    ListedParking page · SedoListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    facebook-community-standards.com
    First seen
    2026-11-04 07:41 UTC
    First published
    2026-11-04 08:03 UTC
    Listing
    CERT Polska listed it 2026-07-23 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-05 08:17 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Encryption Everywhere DV TLS CA - G2
    Valid 2026-11-04 00:00 UTC to 2027-02-01 23:59 UTC
    Logged 2026-11-04 07:39 UTC in DigiCert Wyvern2027h1, entry 399,600,910
    SHA-256 8a03e82e12816e3aed7e127e9627770b188ca15e5f10fd5da4f22070cbd9d84c
    Public key SHA-256 7a1ed642ae2286e75d6fb55d5e25f9588b166c4e33ac76b7204a94c12f406cb4
    Brand
    Facebook
    Addresses
    91.195.240.94 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.94): a parking service. It answers for names that are typically for sale or unused.
    Domain
    facebook-community-standards.com
    Registered
    2026-07-23 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:36 UTC

    Suggest a correction

  9. beacons.ai US · AS13335 · Cloudflare, Inc.2 addresses
    ReportedCloudflareReported by PhishTank as imitating FacebookMX presentSPF ~allDMARC rejectRegistered 9 y ago
    DetailsHide
    Hostname
    beacons.ai
    First seen
    2026-11-03 19:21 UTC
    First published
    2026-11-03 20:36 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-04 20:44 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by WE1 · precertificate
    Valid 2026-11-03 18:15 UTC to 2027-02-01 19:15 UTC
    Logged 2026-11-03 19:15 UTC in DigiCert Sphinx2027h1, entry 345,936,499
    SHA-256 150ea5fb19cd81660eb36a4ef0666df61303fe825104243eb938199e2dd33ff0
    Public key SHA-256 030550ad5c40006547ed3042a570cb9a577fc7d0bb76f171fe314a6e3644c370
    PhishTank
    PhishTank report #9538270
    Brand
    Facebook
    Addresses
    104.20.24.128 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.66.163.43 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    Cloudflare
    Cloudflare (104.20.24.128, 172.66.163.43): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    beacons.ai
    Registered
    2017-12-15 · Marcaria International LLC
    MX
    Receives mail at aspmx.l.google.com, alt1.aspmx.l.google.com, alt2.aspmx.l.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  10. tribelio.page US · AS16509 · Amazon.com, Inc.2 addresses
    ReportedAmazon Web ServicesReported by PhishTank as imitating FacebookMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    tribelio.page
    First seen
    2026-11-03 10:25 UTC
    First published
    2026-11-03 11:04 UTC
    Listing
    PhishTank: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Resolves · checked 2026-11-04 11:13 UTC
    Reported
    PhishTank
    1. Observed in the PhishTank feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Amazon RSA 2048 S25 · precertificate
    Valid 2026-11-03 09:23 UTC to 2027-05-20 10:23 UTC
    Logged 2026-11-03 10:23 UTC in DigiCert Wyvern2027h1, entry 386,999,879
    SHA-256 70cb6adfb22577740ecb1f553b544d7d07d401a1ff5699a0acd1f0e278b84839
    Public key SHA-256 144b7605025cb01ed94ce214f8f0d8998272f486cbd7ad089d9eadd79dafe82f
    PhishTank
    PhishTank report #8339728
    Brand
    Facebook
    Addresses
    18.139.98.34 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    52.221.2.199 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (18.139.98.34, 52.221.2.199): a cloud provider. It rents servers and addresses to its customers.
    Domain
    tribelio.page
    Registered
    2021-07-29 · Namecheap Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 11:04 UTC

    Suggest a correction

  11. indonesia.facebook-ads.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    indonesia.facebook-ads.wasmer.app
    First seen
    2026-11-02 16:37 UTC
    First published
    2026-11-02 16:54 UTC
    DNS
    Resolves · checked 2026-11-04 16:58 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2
    Valid 2026-11-02 15:33 UTC to 2027-01-31 15:33 UTC
    Logged 2026-11-02 16:32 UTC in Google PlumbersArms2027h1, entry 575,587,020
    SHA-256 675ea9acebab8ed588590b0ed8aec42e143827b755db0b102e09d3b94a331193
    Public key SHA-256 8d7cb106d3cf064b22be9ee3e51ca36aa71fff51c7bb8071e80065a260a8279f
    Brand
    Facebook
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  12. meta-verified.live DE · AS47846 · SEDO-AS SEDO GmbH
    ListedParking page · SedoListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    meta-verified.live
    First seen
    2026-11-02 14:36 UTC
    First published
    2026-11-02 15:44 UTC
    Listing
    CERT Polska listed it 2026-07-21 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-04 15:58 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Encryption Everywhere DV TLS CA - G2 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-30 23:59 UTC
    Logged 2026-11-02 14:30 UTC in Let's Encrypt Willow2027h1, entry 897,685,516
    SHA-256 6e8777c1e3cd4843d03780c7fcd7457d203f9b91613728019788e34db87b67cd
    Public key SHA-256 8fc0a7967a7e49d9a284fda6774c9f1a58ba6fe3dae67d3aa7db7a3176d8e88a
    Brand
    Facebook
    Addresses
    91.195.240.94 · Germany · AS47846 SEDO-AS SEDO GmbH · Sedo (parking page)
    Parking page · Sedo
    Sedo (91.195.240.94): a parking service. It answers for names that are typically for sale or unused.
    Domain
    meta-verified.live
    Registered
    2026-07-21 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 00:00 UTC

    Suggest a correction

  13. wwwfacebook.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 12 y ago
    DetailsHide
    Hostname
    wwwfacebook.pl
    First seen
    2026-11-02 14:06 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 13:03 UTC to 2027-01-31 13:03 UTC
    Logged 2026-11-02 14:01 UTC in Let's Encrypt Sycamore2027h1, entry 904,835,775
    SHA-256 b98b32a84e2148d410243d6631ec68fcc69e22df3792df4b08ca5a2017c61305
    Public key SHA-256 6cb255bda71c538eafafb72baa1e521d3c1041b952d35b6017a04d829479e8e4
    Brand
    Facebook
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    wwwfacebook.pl
    Registered
    2014-12-28 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  14. www.wwwfacebook.pl PL · AS48707 · AS48707-OPS-PL AS48707 OPS …
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC rejectRegistered 12 y ago
    DetailsHide
    Hostname
    www.wwwfacebook.pl
    First seen
    2026-11-02 14:06 UTC
    First published
    2026-11-02 14:21 UTC
    DNS
    Resolves · checked 2026-11-04 14:41 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.253.212.22.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.253.212.22
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-11-02 13:03 UTC to 2027-01-31 13:03 UTC
    Logged 2026-11-02 14:01 UTC in Let's Encrypt Sycamore2027h1, entry 904,835,775
    SHA-256 b98b32a84e2148d410243d6631ec68fcc69e22df3792df4b08ca5a2017c61305
    Public key SHA-256 6cb255bda71c538eafafb72baa1e521d3c1041b952d35b6017a04d829479e8e4
    Brand
    Facebook
    Addresses
    185.253.212.22 · Poland · AS48707 AS48707-OPS-PL AS48707 OPS PL sp. z o.o.
    Domain
    wwwfacebook.pl
    Registered
    2014-12-28 · Aftermarket.pl Limited
    MX
    Receives mail at blackhole.aftermarket.pl
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=reject
    Checked
    2026-11-04 14:34 UTC

    Suggest a correction

  15. bcfloraldesigns.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishTank as imitating FacebookMX absentSPF missingDMARC missingRegistered 46 d ago
    DetailsHide
    Hostname
    bcfloraldesigns.com
    First seen
    2026-11-02 09:24 UTC
    First published
    2026-11-02 09:39 UTC
    Listing
    PhishTank: first observed in the feed 2026-11-02 · still listed at the last successful feed check 2026-11-05 09:46 UTC
    DNS
    Not resolving since 2026-11-03 · checked 2026-11-05 09:43 UTC
    Reported
    PhishTank
    1. Certificate logged in CT
    2. Observed in the PhishTank feed
    3. We matched the new listing
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-01 11:08 UTC to 2027-01-30 11:08 UTC
    Logged 2026-11-01 12:07 UTC in Google ParcelYard2027h1, entry 554,989,822
    SHA-256 9f2026cfae43cb25763c9b192c89fc8c813c8de3ce4420132332231600cb328d
    Public key SHA-256 30f0ca8460832c37591ca98cb4951e4d10c60e383f88fea27c175c03921efcda
    PhishTank
    PhishTank report #9553453
    Brand
    Facebook
    Addresses
    104.21.83.51 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.214.205 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3033::6815:5333
    2606:4700:3035::ac43:d6cd
    Cloudflare
    Cloudflare (104.21.83.51, 172.67.214.205): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    bcfloraldesigns.com
    Registered
    2026-09-20 · IONOS SE
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 10:04 UTC

    Suggest a correction

  16. support-securefacebook.com
    ListedListed by MetaMaskMX presentSPF missingDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    support-securefacebook.com
    First seen
    2026-11-02 03:31 UTC
    First published
    2026-11-02 04:28 UTC
    Listing
    MetaMask: first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Not resolving since 2026-11-02 · checked 2026-11-05 04:42 UTC
    Listed
    MetaMask
    1. Observed in the MetaMask feed
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36 · precertificate
    Valid 2026-11-02 00:00 UTC to 2027-01-13 10:52 UTC
    Logged 2026-11-02 03:26 UTC in Geomys Tuscolo2027h1, entry 440,159,025
    SHA-256 993b3c6ed7354be41db32847f89c6f51073fd407defdecadbdb68998dbf48476
    Public key SHA-256 19bfe667d45de15032b0f70ee51a2e9ed91dc191ccd85dc7b7b4c226e0a175c7
    Brand
    Facebook
    Domain
    support-securefacebook.com
    Registered
    2026-05-22 · Cloudflare, Inc.
    MX
    Receives mail at smtp.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 05:03 UTC

    Suggest a correction

  17. latam2.facebook-ads.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    latam2.facebook-ads.wasmer.app
    First seen
    2026-11-01 17:12 UTC
    First published
    2026-11-01 18:03 UTC
    DNS
    Resolves · checked 2026-11-04 18:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-11-01 16:07 UTC to 2027-01-30 16:07 UTC
    Logged 2026-11-01 17:06 UTC in Google PlumbersArms2027h1, entry 558,834,431
    SHA-256 805cc2903644f7aa50cb0cda923f8c97e107d8958c51f47ddaaf40f98d60b588
    Public key SHA-256 da2adafe27fe5967036514d7c38ab66b3fc505bd006fd12a9dda94e19ca6fe24
    Brand
    Facebook
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  18. facebook-ads.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    facebook-ads.wasmer.app
    First seen
    2026-10-31 02:41 UTC
    First published
    2026-10-31 02:53 UTC
    DNS
    Resolves · checked 2026-11-05 02:57 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE2 · precertificate
    Valid 2026-10-31 01:38 UTC to 2027-01-29 01:38 UTC
    Logged 2026-10-31 02:37 UTC in Geomys Tuscolo2027h1, entry 414,896,262
    SHA-256 25ce5d35372e73128b4bcf777f1aa01367b2ec79d2cec5184cfe6b7f071953e8
    Public key SHA-256 d281751069812ed0803fc07050a89833060eb0eb30b8c9b85651b4062d4e5330
    Brand
    Facebook
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  19. r.mail.meta-business-facebook.com FR · AS200484 · SENDINBLUE-ASN Sendinblue S…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF ~allDMARC policy noneRegistered 7 d ago
    DetailsHide
    Hostname
    r.mail.meta-business-facebook.com
    First seen
    2026-10-30 19:01 UTC
    First published
    2026-10-30 19:10 UTC
    DNS
    Not resolving since 2026-10-31 · checked 2026-11-04 19:15 UTC
    Checks
    Overdue since 2026-10-31 19:13 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 172.246.243.65.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 172.246.243.65
    Certificate
    Issued by YR2
    Valid 2026-10-30 17:57 UTC to 2027-01-28 17:57 UTC
    Logged 2026-10-30 18:56 UTC in Google PlumbersArms2027h1, entry 527,781,180
    SHA-256 002adce84d8f9a5493375d96076de2c14c1ff281f63b244c702455fc6205b8a3
    Public key SHA-256 6cf7b5d5171f3b5f660db9e17f3aad48e7649bfc7c0574ef27964dd4e9ac1038
    Brand
    Facebook
    Addresses
    172.246.243.65 · France · AS200484 SENDINBLUE-ASN Sendinblue SAS
    Domain
    meta-business-facebook.com
    Registered
    2026-10-29 · Cloudflare, Inc.
    MX
    Receives mail at smtp.google.com
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-04 20:39 UTC

    Suggest a correction

  20. facebook-appeal-apply.com US · AS16509 · Amazon.com, Inc.2 addresses
    ListedAmazon Web ServicesListed by CERT PolskaMX absentSPF missingDMARC missingRegistered 4 mo ago
    DetailsHide
    Hostname
    facebook-appeal-apply.com
    First seen
    2026-10-30 06:21 UTC
    First published
    2026-10-30 06:35 UTC
    Listing
    CERT Polska listed it 2026-06-25 · first observed in the feed 2026-10-27 · still listed at the last successful feed check 2026-11-05 09:17 UTC
    DNS
    Resolves · checked 2026-11-05 06:39 UTC
    Listed
    CERT Polska
    1. Listed by CERT Polska
    2. Certificate logged in CT
    3. We matched its certificate name
    4. Latest DNS check
    Certificate
    Issued by YR2 · precertificate
    Valid 2026-10-30 05:21 UTC to 2027-01-28 05:21 UTC
    Logged 2026-10-30 06:20 UTC in Geomys Tuscolo2027h1, entry 404,047,665
    SHA-256 1abdb40898e73e355e638da31f2caac10327e5286bab45d87cd9db44e6950075
    Public key SHA-256 ec6b8bf6ee730b331a1094cb4ac7c25f3383c0c20dd115bbd70dc0fc8397260e
    Brand
    Facebook
    Addresses
    64.29.17.65 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    216.198.79.1 · United States · AS16509 AMAZON-02 - Amazon.com, Inc. · Amazon Web Services (cloud provider)
    Amazon Web Services
    Amazon Web Services (64.29.17.65, 216.198.79.1): a cloud provider. It rents servers and addresses to its customers.
    Domain
    facebook-appeal-apply.com
    Registered
    2026-06-25 · Name.com, Inc.
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  21. tracking.facebook-service.com FR · AS16276 · OVH OVH SAS
    Phishing hostOVHAddress hosted confirmed phishing in the last 48 hMX absentSPF ~allDMARC policy noneRegistered 3 mo ago
    DetailsHide
    Hostname
    tracking.facebook-service.com
    First seen
    2026-10-30 00:37 UTC
    First published
    2026-10-30 00:48 UTC
    DNS
    Resolves · checked 2026-11-05 00:53 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 51.254.13.185.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 51.254.13.185
    4. Latest DNS check
    Certificate
    Issued by YR1
    Valid 2026-10-29 23:36 UTC to 2027-01-27 23:36 UTC
    Logged 2026-10-30 00:35 UTC in Google PlumbersArms2027h1, entry 514,860,759
    SHA-256 86cd7451de8accc5632f931c451324e8ddb1c725a2a6282760eddbb28aeb7fb6
    Public key SHA-256 d9558453ccd13ff2add515cda27e964fc15496b0e103317e1c0479d5c18fdcd0
    Brand
    Facebook
    Addresses
    51.254.13.185 · France · AS16276 OVH OVH SAS · OVH (cloud provider)
    OVH
    OVH (51.254.13.185): a cloud provider. It rents servers and addresses to its customers.
    Domain
    facebook-service.com
    Registered
    2026-08-14 · Cloudflare, Inc.
    MX
    Publishes no mail exchanger
    SPF
    SPF record with ~all: other senders soft-fail
    DMARC
    DMARC policy p=none: reports only
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  22. www.facebookpro.com.ua AE · AS59692 · IQWEB IQWeb FZ-LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    www.facebookpro.com.ua
    First seen
    2026-10-30 00:06 UTC
    First published
    2026-10-30 00:48 UTC
    DNS
    Resolves · checked 2026-11-05 00:53 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.115.22.211.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 190.115.22.211
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 23:03 UTC to 2027-01-27 23:03 UTC
    Logged 2026-10-30 00:02 UTC in Google PlumbersArms2027h1, entry 514,417,059
    SHA-256 460d2dcc27417458e35774e438c10a37fef77284f71a8d694887b8989f3f283c
    Public key SHA-256 e163b1841276ee6d6d7c2d45c921d092fed37bc05d36274146b3c71d9c87aabe
    Brand
    Facebook
    Addresses
    190.115.22.211 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    facebookpro.com.ua
    Registered
    2023-08-14 · Hosting Ukraine LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  23. facebookpro.com.ua AE · AS59692 · IQWEB IQWeb FZ-LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 3 y ago
    DetailsHide
    Hostname
    facebookpro.com.ua
    First seen
    2026-10-30 00:06 UTC
    First published
    2026-10-30 00:48 UTC
    DNS
    Resolves · checked 2026-11-05 00:53 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 190.115.22.211.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 190.115.22.211
    4. Latest DNS check
    Certificate
    Issued by YR2
    Valid 2026-10-29 23:03 UTC to 2027-01-27 23:03 UTC
    Logged 2026-10-30 00:02 UTC in Google PlumbersArms2027h1, entry 514,417,059
    SHA-256 460d2dcc27417458e35774e438c10a37fef77284f71a8d694887b8989f3f283c
    Public key SHA-256 e163b1841276ee6d6d7c2d45c921d092fed37bc05d36274146b3c71d9c87aabe
    Brand
    Facebook
    Addresses
    190.115.22.211 · United Arab Emirates · AS59692 IQWEB IQWeb FZ-LLC
    Domain
    facebookpro.com.ua
    Registered
    2023-08-14 · Hosting Ukraine LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 03:07 UTC

    Suggest a correction

  24. www.eu-facebook.com VN · AS135905 · VIETNAM POSTS AND TELECOMMU…3 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 8 d ago
    DetailsHide
    Hostname
    www.eu-facebook.com
    First seen
    2026-10-29 07:06 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.56.163.10.
    1. Resolved to 103.56.163.10
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Facebook
    Addresses
    103.56.163.10 · Vietnam · AS135905 VNPT-AS-VN - VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
    103.166.183.10 · Vietnam · AS135905 VNPT-AS-VN - VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
    103.216.118.10 · Vietnam · AS135905 VNPT-AS-VN - VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
    Domain
    eu-facebook.com
    Registered
    2026-10-28 · iNET SOFTWARE COMPANY LIMITED
    MX
    Receives mail at gw.oxmail.vn
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:55 UTC

    Suggest a correction

  25. eu-facebook.com VN · AS135905 · VIETNAM POSTS AND TELECOMMU…3 addresses
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC quarantineRegistered 8 d ago
    DetailsHide
    Hostname
    eu-facebook.com
    First seen
    2026-10-29 07:06 UTC
    First published
    2026-11-01 06:58 UTC
    DNS
    Resolves · checked 2026-11-05 07:08 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 103.56.163.10.
    1. Resolved to 103.56.163.10
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Facebook
    Addresses
    103.56.163.10 · Vietnam · AS135905 VNPT-AS-VN - VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
    103.166.183.10 · Vietnam · AS135905 VNPT-AS-VN - VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
    103.216.118.10 · Vietnam · AS135905 VNPT-AS-VN - VIETNAM POSTS AND TELECOMMUNICATIONS GROUP
    Domain
    eu-facebook.com
    Registered
    2026-10-28 · iNET SOFTWARE COMPANY LIMITED
    MX
    Receives mail at gw.oxmail.vn
    SPF
    SPF record with -all: other senders fail
    DMARC
    DMARC policy p=quarantine
    Checked
    2026-11-05 08:55 UTC

    Suggest a correction

  26. www.facebook-weide.com US · AS393437 · KLAYER LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    www.facebook-weide.com
    First seen
    2026-10-29 06:32 UTC
    First published
    2026-10-31 07:18 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 72.244.91.252.
    1. Resolved to 72.244.91.252
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Facebook
    Addresses
    72.244.91.252 · United States · AS393437 KLAYER - KLAYER LLC
    Domain
    facebook-weide.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  27. facebook-weide.com US · AS393437 · KLAYER LLC
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX absentSPF missingDMARC missingRegistered 7 d ago
    DetailsHide
    Hostname
    facebook-weide.com
    First seen
    2026-10-29 06:32 UTC
    First published
    2026-10-31 07:18 UTC
    DNS
    Resolves · checked 2026-11-05 07:22 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 72.244.91.252.
    1. Resolved to 72.244.91.252
    2. Phishing-host list fetched with the address
    3. Latest DNS check
    Brand
    Facebook
    Addresses
    72.244.91.252 · United States · AS393437 KLAYER - KLAYER LLC
    Domain
    facebook-weide.com
    Registered
    2026-10-29 · Dominet (HK) Limited
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:54 UTC

    Suggest a correction

  28. facebook.com-l.php-u-review.details.wasmer.app DE · AS213230 · HETZNER-CLOUD2-AS Hetzner O…
    Phishing hostAddress hosted confirmed phishing in the last 48 h
    DetailsHide
    Hostname
    facebook.com-l.php-u-review.details.wasmer.app
    First seen
    2026-10-28 19:06 UTC
    First published
    2026-10-31 00:47 UTC
    DNS
    Resolves · checked 2026-11-05 00:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.161.23.223.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 5.161.23.223
    4. Latest DNS check
    Certificate
    Issued by YE1
    Valid 2026-10-28 18:04 UTC to 2027-01-26 18:04 UTC
    Logged 2026-10-28 19:03 UTC in Google ParcelYard2027h1, entry 493,380,525
    SHA-256 84b34ebfe1891a9548a99edfa5af9e71f562a5439a86f0ec3afae47ee99626fa
    Public key SHA-256 85c0c2b4cbb654317ef095476b8b2423802500abbf96257567a2eb383abbb002
    Brand
    Facebook
    Addresses
    5.161.23.223 · Germany · AS213230 HETZNER-CLOUD2-AS Hetzner Online GmbH

    Suggest a correction

  29. yunkong.facebook18.com HK · AS154206 · CDN1.com Limited
    Spamhaus DROPAddress listed by Spamhaus DROPMX absentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    yunkong.facebook18.com
    First seen
    2026-10-28 08:21 UTC
    First published
    2026-10-28 08:43 UTC
    DNS
    Resolves · checked 2026-11-05 09:04 UTC
    Spamhaus DROP
    A brand lookalike resolving to an address on the Spamhaus Don’t Route Or Peer list. Address 45.125.34.27.
    1. Spamhaus DROP list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 45.125.34.27
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-28 07:19 UTC to 2027-01-26 07:19 UTC
    Logged 2026-10-28 08:18 UTC in IPng Networks Halloumi2027h1, entry 286,379,646
    SHA-256 a459752a9ba0938c0be1f83c8db18caa1137c5cbf3ac24a13df92df970c009ed
    Public key SHA-256 d4f3e3df702970dc4e3bcb5f26eb464144e2ba779333a88758ad3d2e1a1ef4df
    Brand
    Facebook
    Addresses
    45.125.34.27 · Hong Kong · AS154206 CDN1COM-AS-AP - CDN1.com Limited
    Domain
    facebook18.com
    Registered
    2021-12-01 · GoDaddy.com, LLC
    MX
    Publishes no mail exchanger
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-04 13:27 UTC

    Suggest a correction

  30. facebooklive.co.uk GB · AS48254 · TWENTYI 20i Limited
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 6 mo ago
    DetailsHide
    Hostname
    facebooklive.co.uk
    First seen
    2026-10-27 21:11 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 185.151.30.190.
    1. Phishing-host list fetched with the address
    2. Certificate logged in CT
    3. Resolved to 185.151.30.190
    4. Latest DNS check
    Certificate
    Issued by YR1 · precertificate
    Valid 2026-10-27 20:07 UTC to 2027-01-25 20:07 UTC
    Logged 2026-10-27 21:06 UTC in Let's Encrypt Sycamore2027h1, entry 808,567,805
    SHA-256 ad0054064b6f675f175ee85dfd13259899b32f63a185341cd6cbf0dc3b98918c
    Public key SHA-256 fe352e539192819ad096f1a649a3a69c01fe78761680178be2e4125bcbe20625
    Brand
    Facebook
    Addresses
    185.151.30.190 · United Kingdom · AS48254 TWENTYI 20i Limited
    Domain
    facebooklive.co.uk
    Registered
    2026-05-04 · Host Dada Ltd
    MX
    Receives mail at mx.stackmail.com
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:35 UTC

    Suggest a correction

  31. www.facebook.com-c.kl.com.ua NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    www.facebook.com-c.kl.com.ua
    First seen
    2026-10-27 11:26 UTC
    DNS
    Resolves · checked 2026-11-05 00:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.79.66.145.
    1. Phishing-host list fetched with the address
    2. Resolved to 5.79.66.145
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Halloumi2027h1, entry 277,327,186
    SHA-256 6f78fa39b2a171489f6a76157d274ceb90834e8adde47b1c6749fa87cfec4640
    Brand
    Facebook
    Addresses
    5.79.66.145 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    kl.com.ua
    Registered
    2015-02-14 · Ukrainian internet names Center LLC
    MX
    Receives mail at mail.zzz.com.ua
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:33 UTC

    Suggest a correction

  32. facebook.com-c.kl.com.ua NL · AS60781 · LEASEWEB-NL-AMS-01 LeaseWeb…
    Phishing hostAddress hosted confirmed phishing in the last 48 hMX presentSPF -allDMARC missingRegistered 12 y ago
    DetailsHide
    Hostname
    facebook.com-c.kl.com.ua
    First seen
    2026-10-27 11:26 UTC
    DNS
    Resolves · checked 2026-11-05 00:55 UTC
    Phishing host
    A brand lookalike resolving to an address that hosted confirmed phishing in the last 48 hours. Address 5.79.66.145.
    1. Phishing-host list fetched with the address
    2. Resolved to 5.79.66.145
    3. Latest DNS check
    Certificate
    Logged in IPng Networks Halloumi2027h1, entry 277,327,186
    SHA-256 6f78fa39b2a171489f6a76157d274ceb90834e8adde47b1c6749fa87cfec4640
    Brand
    Facebook
    Addresses
    5.79.66.145 · Netherlands · AS60781 LEASEWEB-NL-AMS-01 LeaseWeb Netherlands B.V.
    Domain
    kl.com.ua
    Registered
    2015-02-14 · Ukrainian internet names Center LLC
    MX
    Receives mail at mail.zzz.com.ua
    SPF
    SPF record with -all: other senders fail
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:33 UTC

    Suggest a correction

  33. facebookcustomer-service.com US · AS13335 · Cloudflare, Inc.4 addresses
    ReportedCloudflareReported by PhishDestroyMX presentSPF missingDMARC missingRegistered 5 y ago
    DetailsHide
    Hostname
    facebookcustomer-service.com
    First seen
    2026-10-26 00:05 UTC
    Listing
    PhishDestroy: first observed in the feed 2026-10-25 · still listed at the last successful feed check 2026-11-05 05:51 UTC
    DNS
    Resolves · checked 2026-11-05 09:02 UTC
    Reported
    PhishDestroy
    1. Observed in the PhishDestroy feed
    2. We matched the new listing
    3. Certificate logged in CT
    4. Latest DNS check
    Certificate
    Issued by Sectigo Public Server Authentication CA DV E36
    Valid 2026-10-30 00:00 UTC to 2027-01-20 15:20 UTC
    Logged 2026-10-30 01:30 UTC in Google PlumbersArms2027h1, entry 515,504,542
    SHA-256 62483403c5f045de192c565edd32ec47e12ca0ff665a02d5842ca58d5d5f8a87
    Public key SHA-256 d90ccaf3f075b0dd84a96ece4594f94ae9fcf219bdab9a33fb731ce62d1494cc
    PhishDestroy
    Brand
    Facebook
    Addresses
    104.21.61.117 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    172.67.209.159 · United States · AS13335 CLOUDFLARENET - Cloudflare, Inc. · Cloudflare (cdn)
    2606:4700:3032::ac43:d19f
    2606:4700:3035::6815:3d75
    Cloudflare
    Cloudflare (104.21.61.117, 172.67.209.159): a CDN and reverse proxy. It serves the site from its own network and keeps the origin server private.
    Domain
    facebookcustomer-service.com
    Registered
    2022-02-16 · Dynadot Inc
    MX
    Receives mail at ghs.google.com
    SPF
    Publishes no SPF record
    DMARC
    Publishes no DMARC policy
    Checked
    2026-11-05 08:23 UTC

    Suggest a correction

How certificate findings are selected

Reported: PhishTank or PhishDestroy reports the hostname as phishing. Listed: CERT Polska, MetaMask, USOM, MODA, NPA 165, JPCERT/CC, the AMF, the FSMA or BaFin lists it, in the source's own category. Phishing host: the name resolves to an address on DomainSpoof's phishing-host list, the addresses that hosted confirmed phishing in the last 48 hours. Spamhaus DROP: it resolves to an address on the Spamhaus DROP list. Same certificate: it shares a certificate with a finding and has listing evidence of its own, a report or listing by a source or its own Spamhaus DROP address.

DomainSpoof reads public certificate logs and the feeds on Sources every hour. A hostname matches Facebook when a label carries the brand's name, by the rules on How it works. A lookalike spelling of an official domain matches too. A hostname with two kinds of finding is one row. Details shows the recorded checks, the source's claim and the check times available. How it works · Sources

More brands in Social media

All brands →