# facebook.order91237912832190.shop — SUSPICIOUS

> Is facebook.order91237912832190.shop safe? This domain impersonates Facebook to deceive users, resolving to IP 188.114.97.3.

## Summary
PhishDestroy identifies facebook.order91237912832190.shop as an active domain engaged in brand impersonation of Facebook, posing significant risks to unsuspecting users.

This domain was flagged with a VirusTotal detection rate of 0/95, indicating it has not yet been widely recognized as malicious by security vendors. It resolves to IP address 188.114.97.3 and utilizes a Let's Encrypt SSL certificate, which may lend it an air of legitimacy. The domain’s structure—embedding 'Facebook' in a convoluted subdomain—is a classic tactic to exploit user trust in the legitimate brand. As of now, no blocklist entries or trust score evaluations were found, leaving this threat under-investigated despite its active status.

The primary risk posed by this site is the potential for credential theft through fake login pages or the installation of malware under the guise of a Facebook-related service. Users lured to the site via phishing emails, social media links, or misleading ads may unknowingly disclose login credentials or personal information, which could then be exploited for account takeovers or identity theft. The absence of detections on VirusTotal suggests this domain is still in its early stages of deployment, making it a moving target for traditional security measures. Given the lack of blocklist coverage and the domain’s active status, it is critical to treat this impersonation site with extreme caution. Users should avoid interacting with the domain entirely and report any encounters to Facebook’s phishing reporting channels or their email provider’s security team. Additionally, employing DNS filtering tools or browser-based anti-phishing extensions can help block access to such domains proactively.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)
- Target brand: Facebook

## Domain Intelligence
- Registrar: REGISTRAR_NOT_FOUND
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 0 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/349a6f93-1b52-4d32-954c-bb9201ce5a81
- PhishDestroy: https://phishdestroy.io/domain/facebook.order91237912832190.shop/
- LLM endpoint: https://phishdestroy.io/domain/facebook.order91237912832190.shop/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/facebook.order91237912832190.shop/
Last updated: 2026-03-31