# PhishDestroy domain threat record: mfacebooks.vn Content language: English Canonical HTML report: https://phishdestroy.io/domain/mfacebooks.vn/ Machine-readable companion: https://phishdestroy.io/domain/mfacebooks.vn/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-08-26 09:55:01 UTC - Last availability or vendor check: 2026-10-22 10:13:51 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 16/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Facebook ## Stored infrastructure - Observed IP address: 206.206.126.158 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Registrar country in stored WHOIS data: Unknown - Last stored HTTP status: 301 ## Evidence links - URLScan report: https://urlscan.io/result/01a03d7d-160c-738d-a5c2-77bfe9878e2e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mfacebooks.vn - Certificate Transparency search: https://crt.sh/?q=%25.mfacebooks.vn - Web Archive lookup: https://web.archive.org/web/*/https://mfacebooks.vn/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview mfacebooks.vn is a phishing domain that impersonates Facebook. It adds an "m" to mimic the platform's mobile site and puts it on a Vietnamese country domain, which points to Vietnamese-speaking Facebook users as the main target. PhishDestroy first saw it on 2026-08-26. As of 2026-10-19 the site was still online and redirecting visitors elsewhere. How the scam works Lookalike Facebook domains like this one usually show a copy of the login screen, or a fake security notice, and send whatever the victim types to the operator. A stolen Facebook login can be used to take over the account, message the victim's friends with scams, run ads, or reset passwords on other services tied to the same email. The page title shows a Vietnamese physics study resource, roughly "200 selected true/false questions, Physics grades 10, 11, 12", which does not match the Facebook impersonation we classified. Because the domain now redirects, what a visitor sees may vary. Evidence On 2026-09-30, 16 of 91 VirusTotal engines flagged the domain. They include BitDefender, ESET, Fortinet, G-Data, Forcepoint ThreatSeeker, alphaMountain.ai, CyRadar and Chong Lua Dao. The last two are Vietnamese security vendors, so the warning comes from vendors close to the likely target audience as well as global ones. urlscan.io rated the site malicious and recognized Facebook branding on it. Four AlienVault OTX threat pulses reference it, and PhishDestroy lists it on its blocklist. Infrastructure The domain resolves to 206.206.126.158 on the OVH SAS network in Singapore. That is foreign hosting for a Vietnamese domain that imitates a US platform. It uses a free Let's Encrypt certificate, so the padlock in the browser only means the connection is encrypted. It does not mean the site belongs to Facebook. What to do If you entered your Facebook email, phone number or password on this site, change the password right away from the official Facebook app. Also change it on any other service where you used the same one. Turn on two-factor authentication, review active sessions and log out any devices you don't recognize, and check that your recovery email and phone haven't been changed. Warn your contacts not to trust urgent messages or money requests sent from your account. Defenders should block the domain and its IP at DNS and proxy level and add the "mfacebooks" pattern to lookalike-domain monitoring. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a03d7d-160c-738d-a5c2-77bfe9878e2e/ VirusTotal report: https://www.virustotal.com/gui/domain/mfacebooks.vn Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mfacebooks.vn Archived copy: https://web.archive.org/web/20260826095537/https://mfacebooks.vn/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:56:02 UTC ## Stored page captures - Primary capture: https://i.ibb.co/7xNLZkYG/95b5bdf29727.png Captured: 2026-08-26 09:55:01 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a03d7d-160c-738d-a5c2-77bfe9878e2e.png Captured: 2026-08-26 09:55:01 UTC Source report: https://urlscan.io/result/01a03d7d-160c-738d-a5c2-77bfe9878e2e/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:31:21Z", "uuid": "01a03d7d-160c-738d-a5c2-77bfe9878e2e", "scanned_at": "2026-08-26T09:53:29Z", "final_url": "https://mfacebooks.vn/05ql2jbjvu3d", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://mfacebooks.vn/05ql2jbjvu3d", "from": "http://mfacebooks.vn/05ql2jbjvu3d", "status": 307 } ], "ip": "206.206.126.158", "domains": [ "brscdn.io.vn", "ka-p.fontawesome.com", "cdnjs.cloudflare.com", "ws-ap3.pusher.com", "kit.fontawesome.com" ], "ips": [ "104.18.40.68", "104.21.2.29", "172.64.147.188", "104.17.24.14", "206.206.126.158" ], "asns": [ "13335", "16276" ], "countries": [ "SG" ], "doc_hash": "9a9353239bc7f64c5448cf2356f3fc0419c0351d2784af2270bc5e7cc8c3cb73", "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "$", "jQuery", "Pusher", "phone_check", "string_check", "check_email", "isValidVnPhone", "isValidUSPhone", "pusher", "channel" ], "cookies": [ "XSRF-TOKEN", "viewserver-session" ], "storage_keys": [ "pusherTransportTLS" ], "tls": { "san": [ "mfacebooks.vn" ], "cipher": "AES_256_GCM", "issuer": "YE1", "subject": "mfacebooks.vn", "protocol": "TLS 1.3", "valid_to": "2026-09-30T05:46:06Z", "valid_from": "2026-07-02T05:46:07Z" }, "domain_age_days": 314, "apex_age_days": 314, "tls_age_days": 55, "tls_valid_days": 89, "requests": 18, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 98, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "facebook" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Facebook" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "nginx/1.24.0 (Ubuntu)", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T05:59:09Z", "uuid": "bc794132-2558-4bf6-aece-b4ffe9fd7f7c", "scanned_at": "2026-08-26T10:02:07Z", "final_url": "https://mfacebooks.vn/", "status": 200, "redirected": "https-only", "history": [ { "url": "http://mfacebooks.vn/", "status": 307 }, { "url": "https://mfacebooks.vn/", "status": 200 } ], "dom_hash": "a7fe83ec64bb23eb28090598db3d166ed98e52e39d1afbbfd74c579553f93e4e", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mfacebooks.vn", "type": "A", "value": "206.206.126.158" } ], "dnssec_valid": false, "ip": "206.206.126.158" } } ```