public company · US
Meta (Facebook)
Meta Platforms, Inc.
Facebook, Instagram and WhatsApp.
- Primary official domain
- facebook.com
- Reviewed official domains
- 5 (directory review; organization has not verified)
- Directory source
- BreachScout directory · Suggest a correction
Matching domains, 30 days
152
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
174
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 1/10 lookups · Mail: Receives mail (1 MX host) · checked 2026-10-19 · published policy
What we watch for
Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.
- Brand tokens
- facebookinstagrammetaplatformswhatsapp
- Label aliases
- Facebook · Instagram · Meta Platforms · WhatsApp · Meta
- Official domains
- meta.com · facebook.com · fb.com · instagram.com · whatsapp.com (all)
- Generated spellings
- 400 tracked · 179 observed somewhere · 221 not observed (all)
- Can receive mail
- 3 spellings and 32 reported domains publish MX records · mail at Google 6 · iFastNet 4 · Cloudflare Email Routing (mail forwarding) 2 · 22 more (7 spellings and 152 reported domains of the last 30 days checked; MX shows the domain can receive mail, not who operates it)
Matching domains with source reports or listings
Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.
| Domain / hostname | Source claim | Company match (DomainSpoof) | Date (mixed basis) | Latest DNS | Sources / records | Finding details |
|---|---|---|---|---|---|---|
facebook[.]bora-bora[.]dkMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy none (monitor only) · sends via Google, Mailchimp, send.heyloyalty.com~all | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.26.0.242CloudflareCloudflare (AS13335) · US104.26.1.242CloudflareCloudflare (AS13335) · US172.67.68.76CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
login[.]facebook[.]checkyourbook[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Zoho (consumer mailbox) · DMARC policy none (monitor only) · sends via Zoho | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.107.74.34 · Confirmed phishing host address (DomainSpoof, 14 days)checked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
connect-facebook-net[.]collectasone[.]comMail: MX · checked 2026-10-19mail at Dynadot parking (parking placeholder) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive192.119.111.67 · Confirmed phishing host address (DomainSpoof, 14 days)HOSTWINDS (AS54290) · USclient-192-119-111-67.hostwindsdns.comchecked 2026-10-19 10:50 UTC | 1 source · 1 record | Details |
whatsapp[.]dir[.]com[.]myMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · checked 2026-10-19mail at mail.dir.com.my · sends via HostGator | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive129.121.72.72 · Confirmed phishing host address (DomainSpoof, 14 days)Oracle CloudOracle Cloud (AS31898) · USserver.dir.sgchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
instagram[.]dlscomunicacao[.]com[.]brMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPFDMARC · checked 2026-10-19mail at mail.dlscomunicacao.com.br · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive162.241.2.69 · Confirmed phishing host address (DomainSpoof, 14 days)Oracle CloudOracle Cloud (AS31898) · USns911.hostgator.com.brchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebookcustomer-service[.]comMail: MX · checked 2026-10-19mail at Google (consumer mailbox) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.61.117CloudflareCloudflare (AS13335) · US172.67.209.159CloudflareCloudflare (AS13335) · US2606:4700:3032::ac43:d19fCloudflareCloudflare (AS13335) · US2606:4700:3035::6815:3d75CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebookshops[.]bestMail: MXSPF · checked 2026-10-19mail at Gandi (web / mail hosting) · sends via Gandi | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.36.24CloudflareCloudflare (AS13335) · US172.67.184.51CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:b833CloudflareCloudflare (AS13335) · US2606:4700:3034::6815:2418CloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsapp[.]glutoes[.]comMail: MXDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive51.89.231.112 · Confirmed phishing host address (DomainSpoof, 14 days)OVHOVH (AS16276) · FRchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebook[.]hotzxgirl[.]onlineMail: MXSPFDMARC · checked 2026-10-19mail at Cloudflare Email Routing (mail forwarding) · DMARC policy none (monitor only) · sends via Cloudflare Email Routing | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive216.198.79.65Amazon Web ServicesAmazon Web Services (AS16509) · US64.29.17.65Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
validatewhatsapp[.]hstn[.]meMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebook-spotted-slike[.]infy[.]clickMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.200 · Confirmed phishing host address (DomainSpoof, 14 days)WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
instagram-my[.]ruMail: MXSPF · checked 2026-10-19mail at Timeweb (web / mail hosting) · sends via Timeweb | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.114.247.43 · Confirmed phishing host address (DomainSpoof, 14 days)TIMEWEB-AS (AS9123) · RUvh412.timeweb.ru2a03:6f00:6:1::b972:f72bTIMEWEB-AS (AS9123) · RUchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
instagram[.]jessica-garrido[.]frMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at jessica-garrido.fr · DMARC policy none (monitor only) · sends via spf.jabatus.fr | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive109.234.162.167 · Confirmed phishing host address (DomainSpoof, 14 days)O2SWITCH (AS50474) · FR109-234-162-167.reverse.odns.frchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebookdevelopercircles[.]lapieza[.]ioMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy none (monitor only) · sends via Google, MailerLite, Google Firebase, Microsoft 365 | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive151.101.1.195FastlyFastly (AS54113) · US151.101.65.195FastlyFastly (AS54113) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
whatsapper[.]leadball[.]ruMail: MXSPF · Confirmed phishing host address (DomainSpoof, 14 days) · checked 2026-10-19mail at Yandex (consumer mailbox) · sends via send-box.ru, REG.RU, Yandex | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive37.140.192.61 · Confirmed phishing host address (DomainSpoof, 14 days)AS-REG (AS197695) · RUvip225.hosting.reg.ru2a00:f940:2:2:1:3:0:225AS-REG (AS197695) · RUchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebook[.]meweb[.]kzMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · checked 2026-10-19mail at mail.meweb.kz · sends via _spf.ps.kz | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive195.210.46.27 · Confirmed phishing host address (DomainSpoof, 14 days)PSKZ-ALA (AS48716) · KZsrv-plesk08.ps.kz2a00:5da0:1000::108PSKZ-ALA (AS48716) · KZsrv-plesk08.ps.kzchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
instagram[.]com[.]minttaskapp[.]comMail: MXSPF · checked 2026-10-19mail at minttaskapp.com · sends via _spf.bulutova.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
mail[.]facebookclone-metamaskpayments-4afd7b5f-3507[.]omnicoder[.]app2 hostnames under omnicoder.appMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days)DMARC · checked 2026-10-19mail at app.omni-coder.com · DMARC policy quarantine | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.28.82CloudflareCloudflare (AS13335) · US172.67.170.107CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:1c52CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:aa6bCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
smtp[.]facebookclone-metamask-00237b54-3549[.]omnicoder[.]app | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.28.82CloudflareCloudflare (AS13335) · US172.67.170.107CloudflareCloudflare (AS13335) · US2606:4700:3030::6815:1c52CloudflareCloudflare (AS13335) · US2606:4700:3030::ac43:aa6bCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebooken[.]login[.]piotrpiotr[.]plMail: MX · Confirmed phishing host address (DomainSpoof, 14 days)SPF · Confirmed phishing host address (DomainSpoof, 14 days) · checked 2026-10-19mail at mail.piotrpiotr.pl · sends via hostline.pl | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive46.248.187.185 · Confirmed phishing host address (DomainSpoof, 14 days)IQPL-AS (AS47544) · PLjowisz.hostline.plchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
instagramss[.]rf[.]gdMail: MX · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive185.27.134.24WILDCARD-AS Wildcard UK Limited (AS34119) · GBchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
facebook[.]sagers[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Yahoo (consumer mailbox) · DMARC policy none (monitor only) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive172.210.15.109Microsoft AzureMicrosoft Azure (AS8075) · UScpanel307.turbify.bizchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
facebook[.]redirect[.]securelogin[.]ovhMail: MXSPF · checked 2026-10-19mail at OVH (web / mail hosting) · sends via OVH | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive91.86.0.240 · Confirmed phishing host address (DomainSpoof, 14 days)ORANGE_BELGIUM_SA New company name is Orange Belgium SA (AS47377) · BEchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
loginfacebook[.]site[.]jeMail: MXSPF · checked 2026-10-19mail at iFastNet (web / mail hosting) | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive199.59.243.225Amazon Web ServicesAmazon Web Services (AS16509) · USchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
whatsapp[.]stephenpaulraj[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Proton (consumer mailbox) · DMARC policy quarantine · sends via Proton | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | NXDOMAINchecked 2026-10-19 04:54 UTC | 1 source · 1 record | Details |
whatsapp[.]viewclass[.]comMail: MXSPFDMARC · checked 2026-10-19mail at Google (consumer mailbox) · DMARC policy quarantine · sends via mxsspf.sendpulse.com, mxsmtp.sendpulse.com | Listed by PhishDestroyPresent in latest snapshot | Possible associationBrand in hostname | 2026-10-19Observed in feed | Alive104.21.14.143CloudflareCloudflare (AS13335) · US172.67.159.173CloudflareCloudflare (AS13335) · US2606:4700:3034::6815:e8fCloudflareCloudflare (AS13335) · US2606:4700:3037::ac43:9fadCloudflareCloudflare (AS13335) · USchecked 2026-10-19 10:55 UTC | 1 source · 1 record | Details |
32 registrable domains · 33 hostnames · page 1 of 2Next →
A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.