public company · US

Meta (Facebook)

Meta Platforms, Inc.

Facebook, Instagram and WhatsApp.

Primary official domain
facebook.com
Reviewed official domains
5 (directory review; organization has not verified)
Directory source
BreachScout directory · Suggest a correction
Matching domains, 30 days
152
registrable domains containing the brand; source date or last feed observation
First source-reported, 30 days
0
domains first source-reported within 30 days
First observed, 30 days
174
domains first observed by DomainSpoof in feeds
Email policy (primary domain)
DMARC reject
SPF -all · 1/10 lookups · checked 2026-10-18 · published policy

What we watch for

Hostnames in phishing feeds and certificate logs are matched on these brand tokens; feed target labels are matched on the aliases. Generated spellings (typos, lure words, look-alike characters, other top-level domains) are derived from the official domains and tokens and checked against feeds, certificate logs and DNS.

Brand tokens
facebookinstagrammetaplatformswhatsapp
Label aliases
Facebook · Instagram · Meta Platforms · WhatsApp · Meta
Official domains
meta.com · facebook.com · fb.com · instagram.com · whatsapp.com (all)
Generated spellings
400 tracked · 1 observed somewhere · 399 not observed (all)

Certificate domains matching this brand

Names identified in certificate logs that match this company or brand. A brand match does not indicate bad intent or malicious activity.

Matching domain groups, 30 days
8
distinct registrable domains with a matching certificate name, by latest CT log time; not attacks
Reviewed official
3
groups on this organization's reviewed official domains, 30 days
Not assessed
5
groups with the brand in the name and no review; no judgement implied
Latest CT observation
2026-10-19 01:33 UTC
log timestamp, not issuance or collection time
Matching domain / nameMatched brand / domainMatch typeFirst CT observationLatest CT observationDistinct certificatesRelationshipSource-reported abuseDetails
meta.com6 names · includes wildcard names
meta.comOfficial domain2026-10-19 00:33 UTC2026-10-19 01:33 UTC6Reviewed officialNo report in sample coverage
www.meta.com
meta.comOfficial domain2026-10-19 01:33 UTC2026-10-19 01:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.www.meta.comWildcard certificate name: a pattern, not an observed live host
meta.comOfficial domain2026-10-19 01:33 UTC2026-10-19 01:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
developer.meta.com
meta.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.developer.meta.comWildcard certificate name: a pattern, not an observed live host
meta.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
gateway.developers.meta.com
meta.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
1 more name in this group (most recent shown)
bumiayuvpn.web.id1 name
instagramBrand token in name2026-10-19 01:32 UTC2026-10-19 01:32 UTC1Not assessedNo report in sample coverage
graph.instagram.com.id.bumiayuvpn.web.id
instagramBrand token in name2026-10-19 01:32 UTC2026-10-19 01:32 UTC1Issuer WR1
facebook.net2 names · includes wildcard names
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC2Not assessedNo report in sample coverage
cloud.x2p.facebook.net
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.cloud.x2p.facebook.netWildcard certificate name: a pattern, not an observed live host
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
socialplugin.facebook.net
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.socialplugin.facebook.netWildcard certificate name: a pattern, not an observed live host
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
facebook.com1 name · includes wildcard names
facebook.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Reviewed officialNo report in sample coverage
trunkstable.facebook.com
facebook.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.trunkstable.facebook.comWildcard certificate name: a pattern, not an observed live host
facebook.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
instagram.com2 names · includes wildcard names
instagram.comOfficial domain2026-10-19 00:32 UTC2026-10-19 00:33 UTC2Reviewed officialNo report in sample coverage
upload.instagram.com
instagram.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.upload.instagram.comWildcard certificate name: a pattern, not an observed live host
instagram.comOfficial domain2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
at-od.instagram.com
instagram.comOfficial domain2026-10-19 00:32 UTC2026-10-19 00:32 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.at-od.instagram.comWildcard certificate name: a pattern, not an observed live host
instagram.comOfficial domain2026-10-19 00:32 UTC2026-10-19 00:32 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
viewpointsfromfacebook.com1 name · includes wildcard names
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Not assessedNo report in sample coverage
viewpointsfromfacebook.com
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
*.viewpointsfromfacebook.comWildcard certificate name: a pattern, not an observed live host
facebookBrand token in name2026-10-19 00:33 UTC2026-10-19 00:33 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
facebookstudy.com3 names
facebookBrand token in name2026-10-19 00:32 UTC2026-10-19 00:32 UTC1Not assessedNo report in sample coverage
facebookstudy.com
facebookBrand token in name2026-10-19 00:32 UTC2026-10-19 00:32 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
graph.facebookstudy.com
facebookBrand token in name2026-10-19 00:32 UTC2026-10-19 00:32 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
www.facebookstudy.com
facebookBrand token in name2026-10-19 00:32 UTC2026-10-19 00:32 UTC1Issuer DigiCert Global G2 TLS RSA SHA256 2020 CA1
whatsappmejoinsexx.pages.dev1 name · includes wildcard names
whatsappBrand token in name2026-10-18 23:32 UTC2026-10-18 23:32 UTC1Not assessedNo report in sample coverage
whatsappmejoinsexx.pages.dev
whatsappBrand token in name2026-10-18 23:32 UTC2026-10-18 23:32 UTC1Issuer WE1
*.whatsappmejoinsexx.pages.devWildcard certificate name: a pattern, not an observed live host
whatsappBrand token in name2026-10-18 23:32 UTC2026-10-18 23:32 UTC1Issuer WE1

Collected from public certificate-transparency logs (Cloudflare Nimbus2026, Google Argon2026h2, Google Xenon2026h2) since 2026-10-18; 36,632 log entries checked so far. Collection samples the newest entries of each log, so coverage is partial. Times are CT log timestamps, which differ from certificate validity dates. Certificate counts include precertificates and final certificates as separate artifacts. The "Source-reported abuse" badge appears only when an independent source reported that exact name for this organization; a certificate name match never creates it, and "No report in sample coverage" is not a safety verdict. How CT works