facebook[.]order91237912832190[.]shop

PhishDestroy identifies facebook.order91237912832190.shop as an active domain engaged in brand impersonation of Facebook, posing significant risks to unsuspecting users.

This domain was flagged with a VirusTotal detection rate of 18/95, indicating it has not yet been widely recognized as malicious by security vendors. It resolves to IP address 188.114.97.3 and utilizes a Let's Encrypt SSL certificate, which may lend it an air of legitimacy. The domain’s structure—embedding 'Facebook' in a convoluted subdomain—is a classic tactic to exploit user trust in the legitimate brand. As of now, no blocklist entries or trust score evaluations were found, leaving this threat under-investigated despite its active status.

The primary risk posed by this site is the potential for credential theft through fake login pages or the installation of malware under the guise of a Facebook-related service. Users lured to the site via phishing emails, social media links, or misleading ads may unknowingly disclose login credentials or personal information, which could then be exploited for account takeovers or identity theft. The absence of detections on VirusTotal suggests this domain is still in its early stages of deployment, making it a moving target for traditional security measures. Given the lack of blocklist coverage and the domain’s active status, it is critical to treat this impersonation site with extreme caution. Users should avoid interacting with the domain entirely and report any encounters to Facebook’s phishing reporting channels or their email provider’s security team. Additionally, employing DNS filtering tools or browser-based anti-phishing extensions can help block access to such domains proactively.