https://www.facebook.com/share/p/1DyWxnu3fz/
57.145.2.1 · Meta Platforms Ireland Limited
Ashburn, United States
10651 days
200 · 40.5s
Valid· DigiCert Global G2 TLS RSA SHA256 2020 CA1, DigiCert Inc, US
COMPLETED
Domain Intelligence: facebook.com
Scanned 7 times since Feb 17, 2026, 09:40 AM UTC
Registered-domain escalation
Submit facebook.com as the primary IOC, enriched with evidence from hostile subdomains like www.facebook.com.
No KB/IOK detections were recorded for this scan.
Technology · 6/3/2026
The page presents Facebook branding and login UI on a domain that ultimately resolves to www.facebook.com, with a login form and password field observed in static HTML. However, the final URL path and the initial share URL indicate a redirect chain that could be used to lure users to a login surface. Visual evidence from the screenshot shows Facebook’s branding and a login form, which supports credential collection risk, but the domain remains aligned with official Facebook endpoints; still, the observed redirect to a login surface and the presence of a login form in the page content warrant careful assessment for potential impersonation in a phishing context.
Capture
Stages: 3
Canonical: Late Render (+3s)
Changed: No
Credential Signals
Forms: 1
Password fields: 1
Late-stage login UI: No
Resource Signals
Resources: 54
Hosts: 3
Domains: 3
Suspicious Endpoints
hxxps://www[.]facebook[.]com/login/?next=https%3A%2F%2Fwww.facebook.com%2Fstory.php%3Fstory_fbid%3D122214408812768472%26id%3D61573054160343%26rdid%3DI0COl6XBSZwv2c65%26share_url%3Dhttps%253A%252F%252Fwww.facebook.com%252Fshare%252Fp%252F1DyWxnu3fz%252F&rdid=I0COl6XBSZwv2c65
The scan reveals a legitimate Facebook login surface with a password field and credential submission endpoints, and the page appears to be the official Facebook login experience. However, the presence of a share/story redirect chain that lands on a login surface, combined with a high number of external scripts and POST to internal Facebook AJAX endpoints, creates a potential phishing-facing surface, especially if users arrive through a deceptive URL. Given the strong brand signals but the complex redirect, this warrants monitoring for potential impersonation abuse, and the hosting/registration context should be reviewed to confirm whether this is the authentic Facebook login flow or a spoofed page designed to harvest credentials. Recommendation: monitor; no definitive takedown without additional corroborating abuse signals.
Monitor