# PhishDestroy domain threat record: facebook-verify-business.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/facebook-verify-business.com/ Machine-readable companion: https://phishdestroy.io/domain/facebook-verify-business.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: unknown - First observed by PhishDestroy: 2026-10-26 00:29:39 UTC - Stored record updated: 2026-10-26 02:56:00 UTC - VirusTotal detections in the stored snapshot: 2/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Facebook ## Stored infrastructure - Observed IP address: 35.157.26.135 - Registrar in stored WHOIS data: Name.com, Inc. - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-04-27 07:38:03 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a16ccb-b613-72f8-a121-3f24046e442f/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/facebook-verify-business.com - Certificate Transparency search: https://crt.sh/?q=%25.facebook-verify-business.com - Web Archive lookup: https://web.archive.org/web/*/https://facebook-verify-business.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy listed facebook-verify-business.com as a suspicious domain on 2026-10-26, citing two malicious detections from VirusTotal. The site was first seen by PhishDestroy on 2026-10-26, returned HTTP 200 and displayed the recorded title “Verified badge”. How the scam works The detections indicate the site could be used for phishing or brand impersonation, typically by presenting a fake verification page to lure users into revealing credentials. No malicious payload, credential‑stealing form, or wallet interaction was observed on the captured page. Evidence VirusTotal reported 2 malicious detections out of 92 engines on 2026-10-24, with alphaMountain.ai and SOCRadar labeling the domain as phishing. Google Safe Browsing checked on 2026-10-26 and did not flag the site. URLScan captured the page on 2026-10-24, gave an overall clean verdict but its engine scored it malicious with a 78‑point rating. Cloudflare Radar scanned on 2026-10-26 and marked the domain malicious for malware, while OTX listed one pulse referencing the domain on the same day. PhishDestroy’s internal blocklist includes the domain as of 2026-10-26; external blocklists showed no entries. Infrastructure The domain was registered on 2026-04-27 through Name.com, Inc. Hosting records show the site resolved to Amazon-owned IPs 35.157.26.135 (Germany) and 63.176.8.218, served via Netlify. A Let’s Encrypt TLS certificate covering the domain and its wildcard was issued on 2026-10-24 and is valid until 2027-01-22. What to do Do not enter Facebook credentials or any personal data on the site; if you have already done so, change your Facebook password and enable two‑factor authentication. Report the URL to Facebook’s abuse team and add the domain to local blocklists to prevent future access. Security teams should monitor outbound connections to the recorded IPs and review logs for any interactions with this domain. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a16ccb-b613-72f8-a121-3f24046e442f/ Cloudflare Radar report: https://radar.cloudflare.com/scan/aa6e8a5e-4cfc-4907-a85c-f5db9af3d5e0 Stored capture screenshot: https://urlscan.io/screenshots/01a16ccb-b613-72f8-a121-3f24046e442f.png Cloudflare Radar screenshot (2026-10-26T00:33:14Z): https://screenshots.phishdestroy.io/cf/aa6e8a5e-4cfc-4907-a85c-f5db9af3d5e0.png URLScan screenshot (2026-08-25T08:11:36Z): https://screenshots.phishdestroy.io/us/01a037f9-7603-77fc-b2fa-faded914b473.png URLScan capture report: https://urlscan.io/result/01a037f9-7603-77fc-b2fa-faded914b473/ URLScan screenshot (2026-08-25T08:13:46Z): https://screenshots.phishdestroy.io/us/01a037fb-678f-76ee-b150-a2129ec0ee02.png URLScan capture report: https://urlscan.io/result/01a037fb-678f-76ee-b150-a2129ec0ee02/ VirusTotal report: https://www.virustotal.com/gui/domain/facebook-verify-business.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=facebook-verify-business.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-26 00:35:55 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a16ccb-b613-72f8-a121-3f24046e442f.png Captured: 2026-10-26 00:29:39 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a16ccb-b613-72f8-a121-3f24046e442f.png Source report: https://urlscan.io/result/01a16ccb-b613-72f8-a121-3f24046e442f/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/aa6e8a5e-4cfc-4907-a85c-f5db9af3d5e0.png Captured: 2026-10-26 00:33:14 UTC Source report: https://radar.cloudflare.com/scan/aa6e8a5e-4cfc-4907-a85c-f5db9af3d5e0 SHA-256: e474a175f992442a69e502e42d7748076f7b37bd4715cf7c03ed2b7ff55231c3 - URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a037f9-7603-77fc-b2fa-faded914b473.png Captured: 2026-08-25 08:11:36 UTC Source report: https://urlscan.io/result/01a037f9-7603-77fc-b2fa-faded914b473/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 - URLScan · 2026-08-25: https://screenshots.phishdestroy.io/us/01a037fb-678f-76ee-b150-a2129ec0ee02.png Captured: 2026-08-25 08:13:46 UTC Source report: https://urlscan.io/result/01a037fb-678f-76ee-b150-a2129ec0ee02/ SHA-256: df3ce695eeda95f111b61246eece94247a44e1cee863fd5d0198a9abfe6c9599 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-26T00:34:54Z", "uuid": "01a16ccb-b613-72f8-a121-3f24046e442f", "scanned_at": "2026-10-24T07:24:18Z", "final_url": "https://facebook-verify-business.com/", "status": 200, "ip": "35.157.26.135", "ptr": "ec2-35-157-26-135.eu-central-1.compute.amazonaws.com", "ips": [ "35.157.26.135" ], "asns": [ "16509" ], "countries": [ "DE" ], "doc_hash": "781c78092398f9c08fa315fbbb9abd58a929f452a6e122f930b7cbee38645995", "script_hashes": [ "95096745e4434f89901a6161ab4bd310b0a5c7c5f255b039ad242ab048e864e0", "d6e02711a02054cdbd3536e7202844304baf6db746b5d8fb57c1ebb826987229", "70d9a581917feaf04db236328a1b93b06a5b4c614006f82ccc002b8e92c8ee1a", "3ce79635ba1a3885520a9eb1c0a1f63765d8e001f245d1d6ffe03201e5a6b13e", "86f2440c89b68edd74798c067b372e2080d95b0cc4e1f4f9a230934ce5335f1e", "30388233f3210a09b1c3592c0759e25f4123080405e7a5fed86c92d7e80bdab5", "9f22fb453ab865a9ea023bd88c228bd634d130d8240b85bb233d37e2a2138522" ], "tls": { "san": [ "*.facebook-verify-business.com", "facebook-verify-business.com" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "facebook-verify-business.com", "protocol": "TLS 1.3", "valid_to": "2027-01-22T06:14:06Z", "valid_from": "2026-10-24T06:14:07Z" }, "domain_age_days": 179, "apex_age_days": 179, "tls_age_days": 0, "tls_valid_days": 89, "requests": 10, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 78, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "Netlify", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-26T00:34:56Z", "uuid": "aa6e8a5e-4cfc-4907-a85c-f5db9af3d5e0", "scanned_at": "2026-10-26T00:33:14Z", "final_url": "https://facebook-verify-business.com/", "status": 200, "history": [ { "url": "https://facebook-verify-business.com/", "status": 200 } ], "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e", "doc_hash": "781c78092398f9c08fa315fbbb9abd58a929f452a6e122f930b7cbee38645995", "phishing_v2": [ "phishing" ], "domain_risks": [ "Malware", "Security threats", "CIPA Filter", "CIPA" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "facebook-verify-business.com", "type": "A", "value": "35.157.26.135" }, { "name": "facebook-verify-business.com", "type": "A", "value": "63.176.8.218" } ], "dnssec_valid": false, "ip": "35.157.26.135", "verdict": { "tags": [ "malware" ], "malicious": true, "categories": [ "malware" ] }, "whois": { "registrar": "Name.com, Inc.", "created": "2026-04-27T09:38:03Z", "updated": "2026-04-27T09:38:03Z", "expires": "2027-04-27T09:38:03Z", "nameservers": [ "dns1.p06.nsone.net", "dns2.p06.nsone.net", "dns3.p06.nsone.net", "dns4.p06.nsone.net" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-26T00:31:55Z", "analysis_at": "2026-10-24T17:13:26Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 2, "suspicious": 0, "undetected": 35 }, "detections": { "SOCRadar": "phishing", "alphaMountain.ai": "phishing" }, "reputation": 0, "registrar": "Name.com, Inc.", "created": "2026-04-27T09:38:03Z", "expires": "2027-04-27T09:38:03Z", "updated": "2026-04-27T09:38:03Z", "first_seen": "2026-04-27T09:54:16Z", "dns": [ { "ttl": 3600, "type": "NS", "value": "dns3.p06.nsone.net" }, { "ttl": 120, "type": "A", "value": "98.84.224.111" }, { "ttl": 3600, "type": "NS", "value": "dns1.p06.nsone.net" }, { "ttl": 3600, "type": "NS", "value": "dns4.p06.nsone.net" }, { "ttl": 3600, "type": "SOA", "rname": "domains+netlify.netlify.com", "value": "dns1.p01.nsone.net" }, { "ttl": 3600, "type": "NS", "value": "dns2.p06.nsone.net" }, { "ttl": 120, "type": "A", "value": "18.208.88.157" } ], "dns_at": "2026-10-24T17:23:01Z", "jarm": "40d40d40d00000000043d43d00043d6aff5ab0f4fc31897186312c9e639319", "cert": { "san": [ "*.facebook-verify-business.com", "facebook-verify-business.com" ], "issuer": "Let's Encrypt / YE1", "serial": "6a2be9a6717389db95261a74d4429b99054", "sha256": "bcf0a67058fbd8aa68cb7a1c48b15c712a30229f1c565e84acb213b49b0cb6a5", "subject": "facebook-verify-business.com", "valid_to": "2027-01-22T06:14:06Z", "valid_from": "2026-10-24T06:14:07Z" }, "whois": { "registrar": "Name.com, Inc.", "registrar_iana_id": "625", "registrar_url": "http://www.name.com", "created": "2026-04-27T09:38:03Z", "updated": "2026-04-27T09:38:03Z", "expires": "2027-04-27T09:38:03Z", "status": [ "clientTransferProhibited" ], "nameservers": [ "dns1.p06.nsone.net", "dns2.p06.nsone.net", "dns3.p06.nsone.net", "dns4.p06.nsone.net" ], "dnssec": "unSigned" }, "rdap": { "status": [ "transfer prohibited" ], "events": { "expiration": "2027-04-27T09:38:03Z", "last changed": "2026-04-27T09:38:03Z", "registration": "2026-04-27T09:38:03Z", "registrar expiration": "2027-04-27T09:38:03Z", "last update of RDAP database": "2026-04-27T09:38:03Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-26T00:35:15Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "facebook-verify-business.com" }, "block_lists": { "resolvers": 12, "blocked_by": [ "CloudFlare Family" ], "blocked_count": 1 }, "archives": { "last": "2026-10-26T00:32:34Z", "first": "2026-10-17T00:17:13Z", "changes": 1, "days_archived": 2, "scans_per_day": 0.11, "avg_page_bytes": 1384 }, "social_tags": { "ogUrl": "https://69ef2ca59d6157c25c33e6dc--astounding-torte-aecffa.netlify.app", "title": "Verified badge", "ogType": "website", "ogImage": "https://i.ibb.co/M56GDz14/opengraph-image.jpg", "ogTitle": "Facebook Terms and Policies", "description": "Review and manage your Facebook account settings and preferences.", "ogDescription": "Review and manage your Facebook account settings and preferences." }, "trackers": { "requests": 9 }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 29, "tls": 119, "wait": 120, "connect": 7, "download": 0 }, "response_ms": 275 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_128_GCM_SHA256", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443 ] }, "carbon": { "bytes": 1311, "co2_grams": 0, "cleaner_than": 95 }, "dns_server": { "ns": [ { "ip": "198.51.44.6", "host": "dns1.p06.nsone.net" }, { "ip": "198.51.45.6", "host": "dns2.p06.nsone.net" }, { "ip": "198.51.44.70", "host": "dns3.p06.nsone.net" }, { "ip": "198.51.45.70", "host": "dns4.p06.nsone.net" } ], "zone": "facebook-verify-business.com" }, "location": { "ip": "63.176.8.218", "asn": "16509", "org": "Amazon.com, Inc.", "city": "Frankfurt am Main", "country": "DE" }, "ssl": { "issuer": "Let's Encrypt / YE1", "subject": "facebook-verify-business.com" }, "dns": { "A": [ "63.176.8.218", "35.157.26.135" ], "NS": [ "dns4.p06.nsone.net", "dns3.p06.nsone.net", "dns1.p06.nsone.net", "dns2.p06.nsone.net" ], "SOA": "{\"nsname\": \"dns1.p01.nsone.net\", \"hostmaster\": \"domains+netlify.netlify.com\", \"serial\": 1777282680, \"refresh\": 43200, \"retry\": 7200, \"expire\": 1209600, \"minttl\": 3600}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "35.157.26.135", "family": 4 }, "redirects": { "chain": [ "https://facebook-verify-business.com" ] }, "whois": { "registrar": "Name.com, Inc.", "created": "2026-04-27T09:38:03Z", "updated": "2026-04-27T09:38:03Z", "expires": "2027-04-27T09:38:03Z", "status": [ "clientTransferProhibited https://icann.org/epp" ], "nameservers": [ "dns1.p06.nsone.net", "dns2.p06.nsone.net", "dns3.p06.nsone.net", "dns4.p06.nsone.net" ] }, "headers": { "headers": { "server": "Netlify", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=31536000" } } } } ```