phishunt.io flags swiftpoint.cyou fake Facebook login phishing page
phishunt.io flagged swiftpoint.cyou as a fake Facebook login phishing page at /facebook/login. The domain is also on the Phishing Army blocklist.
- First reported
- Reports
- 1
Source: x.com · published
What happened
On 5 November 2026 the phishing tracker phishunt.io posted on X a Facebook phishing page at swiftpoint.cyou/facebook/login. It reported that the domain was registered on 12 October 2026, resolves to 20.106.126.48 (Microsoft Corporation, AS8075, United States), and carries a registrar tag associated with Global Asset Domains. The domain also appears on the Phishing Army community blocklist. It is not a Facebook or Meta domain.
How the scam works
Facebook login phishing usually arrives as a message saying the account will be locked, that a login attempt failed, or that a marketplace deal needs confirmation. The link opens a page that copies Facebook's login form on an unrelated domain. After the email or phone and password are entered, the page often asks for a one-time code, which lets the criminals take over the account in real time.
With a Facebook login, criminals can lock out the real owner, message friends with further scams, empty any stored payment methods, or hijack connected business pages. Meta's guidance is to reach Facebook only through the official app or by typing facebook.com, never through a link in a message. Anyone who entered details should change their Facebook password immediately, review active sessions and connected apps, and enable stronger authentication. The domain and technical details come from the phishunt.io post and the blocklist listing, and have not been independently checked by scammers.com beyond those sources.
Microsoft-hosted IP addresses are used by both legitimate Azure customers and phishing operators, so the AS8075 attribution alone does not prove who controls the page. The combination of a Facebook login path on an unrelated .cyou domain, a recent registration date and a blocklist hit is what makes the report actionable. Always check the address bar before typing a Facebook password.
Source
Post by @phishunt_io on X, 5 November 2026, flagging swiftpoint.cyou/facebook/login. Not independently verified by scammers.com.
Red flags
- A Facebook login page on a domain that is not facebook.com.
- A recently registered domain such as swiftpoint.cyou.
- Messages saying your account will be locked unless you confirm details.
- A request for a one-time code right after the password.
- A path such as /facebook/login on an unrelated site.
If you were targeted
- 1Do not enter passwords, card numbers or one-time codes on a page reached from a text, email or ad.
- 2Open the company's official app or type its address yourself to check your account.
- 3If you entered details, change your password at once and contact the company through its official channels.
- 4Report the message and the link to the company and to your national phishing reporting service.
- 5Delete the message without replying or tapping any links.