Insights and Research

Facebook Phishing Pages

On 02/13/2011, I found several domains used for Facebook phishing, registered the same day:
These domains contain the same page: a simple form to enter a Facebook login and password.

Facebook Phishing page

After entering the credentials, users are redirected to!/album.php?profile=1&id=208421665712, which lands the user at their Profile Pictures page. If the user was not yet logged into Facebook, he must login "again". The phishing page does not post the credentials to Facebook on the user's behalf.

Fast-flux DNS

All of the domains were registered by the same individual in China.
WHOIS information for 

The domains are bound to multiple IP addresses that change rapidly (aka fast-flux DNS):
DNS information for
They all use the DNS server, which has been used for other Facebook phishing sites in the past.

Random redirections

On 02/14/2011, these 6 domains where redirecting users to in the morning. In the afternoon, they redirected users to On 02/16/2011, they seem to display the phishing pages all the time. I'm not sure why these redirections were set up earlier.

These domains are not yet blocked by Google Safe Browsing.

-- Julien

    Stay up to date with the latest digital transformation tips and news.

    By clicking the submit button, you are agreeing to our privacy policy.