authfacebook[.]hb[.]gwfaoli[.]com

On 23 July 2026, the domain authfacebook.hb.gwfaoli.com was observed to be offline but retains indicators of a high‑risk brand‑impersonation campaign targeting Facebook users. The domain was registered on 6 March 2026 through IONOS SE and resolves to the IPv4 address 216.250.125.37, which is hosted in the United States under ASN 8560 (IONOS SE). No TLS certificate is presented, meaning connections are unencrypted. DNS resolution is provided by ns1.fanoermano.info and ns2.fanoermano.info.

The site title returned by HTTP requests is “Facebook - log in or sign up”, matching the declared scam type of Social Media Phishing and the declared impersonated brand, Facebook. Reputation checks show the domain appears on a single security blocklist and is flagged by Google Safe Browsing for social engineering. PhishDestroy has also listed the domain as blocked. VirusTotal analysis reports that 13 of 95 scanned security vendors flagged the domain, indicating a moderate consensus of malicious behavior.

The limited number of detections may reflect the short lifespan of the domain, which was taken offline shortly after creation. Given the combination of brand impersonation, lack of encryption, and multiple independent detections, defenders should add authfacebook.hb.gwfaoli.com to deny‑list rules for DNS and proxy filtering, monitor traffic to the associated IP 216.250.125.37, and consider sinkholing the host to disrupt any residual command‑and‑control activity. Continuous re‑inspection of the IP and its associated name servers is advised, as the infrastructure could be reused for future campaigns. Because the site is currently offline, there is no active payload to retrieve, but the presence of the domain on blocklists and its association with Facebook phishing indicates a high likelihood of credential‑harvesting intent.