facebook.hosweb.online is a phishing page that impersonates Facebook. It uses the brand name as a subdomain and the familiar "Facebook - Log In or Sign Up" title so that it looks like the real sign-in screen to anyone who lands on it. PhishDestroy first saw it on 2026-10-03. As of 2026-10-19 the site was still listed as alive, but its DNS was inactive, so the fake login page was not being served at that point.
How the scam works
Victims usually reach a page like this through a link in a message, comment, ad or fake security alert that warns about their account. The page copies Facebook's login form, and any email, phone number or password typed into it goes to the operators. With those credentials they can take over the account, lock out the owner, message friends with further scams, run fraudulent ads or pages, and try the same password on other services.
Evidence
Independent detections agree with our classification. On 2026-10-06, 22 of 91 VirusTotal engines flagged the domain, including BitDefender, ESET, Emsisoft, alphaMountain.ai, CRDF, CyRadar, Ermes and Chong Lua Dao. Google Safe Browsing lists it under SOCIAL_ENGINEERING, which triggers warnings in major browsers. urlscan.io rated the page malicious and recognised Facebook branding on it. Spamhaus lists it in its DBL as an abused phishing domain, and it appears on the PhishDestroy blocklist.
Infrastructure
The parent domain hosweb.online was registered through Namecheap on 2025-11-28, about ten months before we detected the Facebook lure. Phishing operators often use a generic, aged parent domain and add brand-named subdomains when they need them. The page was hosted on Amazon's AWS network at an address in Australia. Its Let's Encrypt certificate means the browser shows a padlock, but the padlock only shows that the connection is encrypted. It does not show that the site is really Facebook.
What to do
If you entered your Facebook login on this page, change your Facebook password right away and change it on any other service where you used the same one. Turn on two-factor authentication, preferably with an authenticator app. Then review active sessions and log out unknown devices, and check that your recovery email and phone number have not been changed. Warn your contacts not to trust unusual messages sent from your account recently. Defenders should block facebook.hosweb.online and watch for other brand-named subdomains under hosweb.online.
DOM Analysisanalyzed 2026年10月9日score 98/1002 brand signals
Submitted URLhttp://facebook.hosweb.online/
Favicon Hash
ICANN OVERSIGHTRegistration: hosweb.online
認定と RAA の背景
Registrar accreditation and DNS abuse obligations
For the registrable domain hosweb.online behind this subdomain, the registrar above operates under an ICANN accreditation agreement. The links below provide the official fee schedule and current DNS abuse compliance guidance.
Accreditation is a contract, not a safety certification.
RAA §3.18 establishes abuse-contact and handling requirements. This report can document stored outbound notices and later technical observations; it does not by itself establish receipt, investigation, remediation, or contractual non-compliance.
Saved certificate metadata. Certificate dates without a timezone are shown as stored. Transport encryption does not establish that the site is trustworthy.
Primary outcomeDNS 非アクティブreason: DNS NXDOMAIN80% confidence
Attributionsource: Dns Cache
Evidence layersAvailability: DNS inactiveContent: UnreachableDNS: NXDOMAINRegistration: Unknown
Latest HTTP observation不明Probe Inconclusive20%2026-10-19 22:38:32 UTC
RDAP registration不明
Observed timelinelast reachable: 2026-10-03 16:45:47 UTCcurrent episode first observed: 2026-10-05 22:13:39 UTCobserved RIP window: 2026-10-03 16:45:47 UTC → 2026-10-05 22:13:39 UTC · 53.46hmidpoint estimate ≈ 2026-10-04 19:29:43 UTC · precision low · basis bounded
Availability, content, DNS and registration are independent evidence layers. NXDOMAIN, an unreachable origin or missing content alone does not prove registrar action. A registrar or provider is credited only when a direct technical marker identifies that actor. Report causality is shown separately.
使用技術 · 3 identified
D
Debian
Operating systems
Debian is a Linux software which is a free open-source software.
Keep original emails, receipts, messages and screenshots in a secure place. A factual timeline helps the receiving authority understand what happened. IC3 evidence guidance ↗
Payment records — if you paid, save the receipt, amount, date, payment provider and recipient details.
Your bank or payment provider — contact its fraud team promptly through official contact details if money or card information was exposed.
地元の警察 — たとえ直ちに行動を起こせなくても、公式な記録が残される
A report is not a guarantee of recovery or investigation, but prompt, accurate transaction data can help authorities and service providers trace the incident.
詐欺による金銭の返還を装った詐欺 — fraudsters pose as recovery agents and demand upfront fees. Never share a seed phrase or pay before independently verifying the provider
About this reportSources, observation dates and corrections
This report combines saved page captures, registration and network records, scanner results and PhishDestroy reporting history. Each source keeps its own observation date. Open a source report to inspect the original result.
The AI-assisted analysis was written on . It describes the evidence available at that time; later source checks can change.
A capture documents what was shown. A scanner result records that provider’s assessment at the time of its check. Neither a valid certificate nor a zero-detection result is a guarantee of safety.
(US)
