phishunt.io flagged m-facebookk.com.vn as a Facebook phishing site on OVH in Singapore; it also appears on Phishing Army and OpenPhish. Facebook/Meta is not involved.
Source: x.com · published
On 8 November 2026 the phishing tracker phishunt.io flagged m-facebookk.com.vn as a Facebook phishing site, posting the phishing URL m-facebookk[.]com[.]vn/5u0e1rsrqbe with a screenshot and listing its hosting as IP 206.206.126.131 at OVH SAS (AS16276) in Singapore, tagged YE2. The domain, a lookalike of Facebook's mobile site with a doubled 'k' on a Vietnamese .com.vn address, also appears on the Phishing Army extended blocklist, and the OpenPhish public feed lists a separate phishing URL on the same domain. Facebook and Meta are impersonated and are not involved.
The screenshot shows a Vietnamese-language copy of the Facebook login page with fields for mobile number or email and password, a Log in button and Meta branding at the bottom. Anything typed into the form goes to whoever runs the page rather than to Meta. The doubled letter in facebookk and the .com.vn ending are easy to miss when the page looks familiar, especially on a phone where the address bar is small.
Facebook phishing links commonly arrive in messages claiming a security alert, a friend request, a copyright complaint or a login from a new device. Stolen credentials can be used to take over the account, message friends with further scams, reset passwords on other services that use the same email, or sell access. Because the domain is already on public blocklists, some browsers may warn visitors, but newly created paths can stay online for a while.
Open Facebook only through the official app or facebook.com typed yourself. Anyone who entered details on m-facebookk.com.vn should change their Facebook password immediately, enable two-factor authentication, review active sessions and apps, and change the same password on any other service. The details come from the tracker's post and the public blocklists cited above and have not been independently checked by scammers.com.
Post by phishunt.io on X, 8 November 2026, flagging m-facebookk.com.vn. Not independently verified by scammers.com.
PhishDestroy posted on Mastodon on 12 November 2026 that xncok12[.]weebly[.]com is a phishing page. Its record describes a GMX.NET-branded email and password login form, flagged by 17 of 92 VirusTotal engines. GMX is…
PhishDestroy posted on Mastodon on 12 November 2026 that xfinitywebmailw3r[.]weebly[.]com is a phishing page. Despite the Xfinity name in the address, its record describes a Network Solutions-branded webmail login for…
The OSINT account BeeSINT posted on Mastodon on 12 November 2026 a 'Phishing Spotlight' on facebook-profile-login[.]blogspot[.]com, built on Blogger, linking its analysis. The domain also appears on the Phishing Army…
PhishDestroy posted on Mastodon on 12 November 2026 that xxvv435[.]weebly[.]com is a phishing page. Its record describes an Onet Poczta login page with email and password fields, flagged by 19 of 92 VirusTotal engines…
PhishDestroy posted on Mastodon on 12 November 2026 three Weebly-hosted pages it flagged as phishing: zimbfree[.]weebly[.]com, zimbrafree9[.]weebly[.]com and zim-update2025[.]weebly[.]com. Its records describe Zimbra-…
ScanMalware posted on X on 12 November 2026 that payee-security-online[.]web[.]app is a confirmed scam. Its scan report says the host matches an analyst-vetted UK bank account-recovery phishing kit impersonating Santa…