onesharegoodness[.]com

This domain, onesharegoodness.com, is a confirmed credential-theft phishing site impersonating Facebook. The site presents a fraudulent login page titled 'Facebook log-in or sign-up' designed to harvest user credentials, including email addresses and passwords. Such attacks enable unauthorized access to accounts, identity theft, and further social engineering campaigns targeting connected users or linked services. The threat is particularly effective due to the widespread use of Facebook for authentication across third-party platforms, increasing the potential impact of compromised credentials. Analysis indicates that onesharegoodness.com was registered on July 21, 2025, through Cosmotown, Inc., and resolves to the IP address 91.204.209.26, hosted on AS52148 (Enix Ltd) in the United Kingdom. The domain is flagged by 23 out of 95 security vendors on VirusTotal, with additional detections from Google Safe Browsing and at least one other security blocklist. The SSL certificate is issued by Let's Encrypt (R12), a common tactic used to lend false legitimacy to phishing sites. The page title and visual design closely mimic Facebook’s official login interface, increasing the likelihood of user deception. Users who visited onesharegoodness.com and entered credentials should assume their account has been compromised. Immediate steps include changing the password on the legitimate Facebook platform and enabling multi-factor authentication (MFA) if not already active. Review recent account activity for unauthorized logins or posts, and revoke access to any suspicious third-party applications. Monitor linked email accounts for password reset attempts or unusual activity, as attackers may attempt to pivot to other services. If financial or personal data was entered, consider reporting the incident to relevant authorities and credit monitoring services to mitigate potential identity theft risks.