public company · US

Meta (Facebook)

Meta Platforms, Inc.

Facebook, Instagram and WhatsApp.

Primary official domain
facebook.com
Reviewed official domains
5 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
152
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
174
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 1/10 lookups · Mail: Not checked · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
facebookinstagrammetaplatformswhatsapp
Label aliases
Facebook · Instagram · Meta Platforms · WhatsApp · Meta
Official domains
meta.com · facebook.com · fb.com · instagram.com · whatsapp.com (all)
Generated spellings
400 tracked · 4 observed somewhere · 396 not observed (all)

Matching domains with source reports or listings

Source claims are shown separately from our company matches. Default scope: brand in hostname. Choose “All associations” to include source-labelled matches on other sites.

Domain / hostnameSource claimCompany match (DomainSpoof)Date (mixed basis)Latest DNSSources / records
mail[.]facebookclone-metamaskpayments-4afd7b5f-3507[.]omnicoder[.]app2 hostnames under omnicoder.appMail: MXSPFDMARC · via omni-coder.com · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.28.82172.67.170.1072606:4700:3030::6815:1c522606:4700:3030::ac43:aa6bchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
smtp[.]facebookclone-metamask-00237b54-3549[.]omnicoder[.]app
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.28.82172.67.170.1072606:4700:3030::6815:1c522606:4700:3030::ac43:aa6bchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
secure[.]orbit-whatsapp[.]comMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.85.228172.67.211.2242606:4700:3034::6815:55e42606:4700:3037::ac43:d3e0checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
facebook[.]order81923712831901[.]shopMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.11.240172.67.131.2142606:4700:3034::6815:bf02606:4700:3037::ac43:83d6checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
pc-instagram[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
facebooken[.]login[.]piotrpiotr[.]plMail: MXSPF · via piotrpiotr.pl · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive46.248.187.185checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
power-whatsappp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.72.117172.67.183.1792606:4700:3030::6815:48752606:4700:3030::ac43:b7b3checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
power-whatsappp[.]hl[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.16.8172.67.165.1652606:4700:3032::ac43:a5a52606:4700:3034::6815:1008checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
premio-instagram[.]comMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive185.158.133.1checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
whatsapp[.]prosulequipamentos[.]com[.]brMail: MXSPFDMARC · via prosulequipamentos.com.br · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive177.104.186.233checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
qrcode-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
qx-web-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive54.215.31.113checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
real-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
rekemonedasi-facebook[.]orgMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.74.112172.67.157.2372606:4700:3031::6815:4a702606:4700:3036::ac43:9dedchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
instagramss[.]rf[.]gdMail: MX · via ifastnet11.org · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive185.27.134.24checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
rzty-web-whatsapp[.]hk[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.12.48172.67.193.1702606:4700:3033::ac43:c1aa2606:4700:3037::6815:c30checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
facebook[.]sagers[.]comMail: MXSPFDMARC · via yahoodns.net · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive172.210.15.109checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
saque-instagram[.]comMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive185.158.133.1checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
facebook[.]redirect[.]securelogin[.]ovhMail: MXSPF · via ovh.net · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive91.86.0.240checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
secureproxy-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
try[.]sigma-whatsapp[.]comMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.17.34172.67.220.1292606:4700:3031::6815:11222606:4700:3032::ac43:dc81checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
loginfacebook[.]site[.]jeMail: MXSPF · via ifastnet11.org · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive199.59.243.225checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
whatsapp[.]stephenpaulraj[.]comMail: MXSPFDMARC · via protonmail.ch · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
tap-to-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
thinkim-whatsappp[.]hl[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
Alive104.21.3.103172.67.153.1312606:4700:3032::6815:3672606:4700:3036::ac43:9983checked 2026-10-19 04:54 UTC
1 source · 1 recordDetails
top-for-whatsapp[.]com[.]cnMail: No mail records · checked 2026-10-19
Listed by PhishDestroyPresent in latest snapshot
Possible associationBrand in hostname
2026-10-19Observed in feed
NXDOMAINchecked 2026-10-19 04:54 UTC
1 source · 1 recordDetails

A feed listing or DNS answer alone cannot confirm current phishing. Removal from a feed does not confirm resolution.