whopostedwhat[.]com

The domain www.whopostedwhat.com has been identified as a phishing site engaged in brand impersonation targeting Facebook users. The scam type is social_media, and the site was designed to mimic Facebook in an attempt to deceive users, likely to steal credentials or personal information. As of the latest assessment, www.whopostedwhat.com is currently taken offline and remains under investigation for its involvement in this phishing activity.

Technical analysis shows that www.whopostedwhat.com was registered through The Registrar Company B.V. on March 12, 2018, with nameservers ns1.thednscompany.com, ns2.thednscompany.com, and ns3.thednscompany.com. The domain resolves to IP address 45.82.191.84, located in the Netherlands (AS31477 Duocast B.V.), and uses an SSL certificate issued by Let's Encrypt / R13. The site was observed running PHP, Bootstrap, LiteSpeed, jQuery, and HTTP/3. VirusTotal reports 0 of 95 vendors detecting the domain, and Google Safe Browsing has not flagged it, but it is listed on one security blocklist (PhishDestroy). The page title observed was 'Who posted what?'.

If a user interacted with www.whopostedwhat.com and entered Facebook credentials, it is critical to change passwords immediately and enable two-factor authentication on the affected account. Users should monitor for unauthorized activity and report any suspicious incidents to Facebook and relevant authorities. Reporting the phishing attempt to security organizations and blocklists can help prevent further harm to others.