www.facebook.com - URL scan, 20 Aug 2026
MalwareAnalyzer by Cyble scanned www.facebook.com and returned a benign verdict (score 0), categorised as credential-harvest. The page resolved to 157.240.8.35 on Facebook, Inc. in AU. The domain was registered 10736 days ago through RegistrarSafe, LLC. 5 domains and 2 IPs were contacted. 106 malware samples communicate with this URL (Fileinfector). The request followed 1 redirect before landing. This is a point-in-time observation from 20 Aug 2026; the page may have changed since.
Scan result
- Verdict: benign (score 0) · Confidence 12%
- Scanned URL:
https://connect.facebook.net/ - Domain: www.facebook.com · IP: 157.240.8.35 · AS32934 · AU
- Page title: Facebook
- HTTP status: 200 · text/html; charset="utf-8"
- Registrar: RegistrarSafe, LLC · domain age 10736 days · created 1997-03-29
- TLS issuer: C=US, O=DigiCert Inc, CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1 · valid to Aug 27 23: · subject C=US, ST=California, L=Menlo Park, O=Meta Platforms, Inc., CN=*.facebook.com
- Evidenced operator: Meta Platforms, Inc.
- Scan tier: fast · observed 2026-08-20 22:17:23 UTC
Redirect chain
https://connect.facebook.net/https://www.facebook.com/
Malware communicating with this URL (106)
These samples were observed contacting or being served from www.facebook.com. Each links to its full analysis.
- Fileinfector - contacted ·
a120bb56775bd34337709b59a91c7a28· first seen 2026-08-20 - fa1a7bae8f976d92c78e190c98b5bc1b0375cc79bcd25c3ccabcea4baa1d7232 - referenced ·
fa1a7bae8f976d92c78e190c98b5bc1b· first seen 2026-08-20 - 8553371fa39c8529660192fe165d8fb73e58c3701ab09fe5e051a293b05c7cb3 - referenced ·
8553371fa39c8529660192fe165d8fb7· first seen 2026-08-20 - dcc655189ea41cb28c4b34b607d7cb3da6021eef6303edafbe7e6d78773cee74 - referenced ·
dcc655189ea41cb28c4b34b607d7cb3d· first seen 2026-08-20 - dcc1053dd00b1bb7f1ee495afa28a6f588a527b93c0500f12c7e5e1df39a285b - referenced ·
dcc1053dd00b1bb7f1ee495afa28a6f5· first seen 2026-08-20 - 82022d85bdd245a5c1b9c0c9600f4332d51ef13ede049baf4641ace36f5cdea5 - referenced ·
82022d85bdd245a5c1b9c0c9600f4332· first seen 2026-08-20 - Fileinfector - contacted ·
8be1f1d3f59476f6988d0a84cbf727ea· first seen 2026-08-20 - dcc900c8d8966d92a7c259d5994b90288ed07b5f6003643aa1ee99fe7225a02a - referenced ·
dcc900c8d8966d92a7c259d5994b9028· first seen 2026-08-20 - Fileinfector - contacted ·
63802cd8505b8595a84c33afe129f289· first seen 2026-08-20 - Fileinfector - contacted ·
5526cdfe9384d63ab4beb181703f909c· first seen 2026-08-20 - Fileinfector - contacted ·
1fb413ec63f1dc7b71d058d53a8d78f4· first seen 2026-08-20 - dcceaf023fe8369c61f315deda7d49554a72b1dd7ef8914e6fdbbbb680beae09 - referenced ·
dcceaf023fe8369c61f315deda7d4955· first seen 2026-08-20 - dcc7cb5b07bedb3329bbb525350e7c8130a39221a2c951ebfc55f3edfae8182e - referenced ·
dcc7cb5b07bedb3329bbb525350e7c81· first seen 2026-08-20 - 2b15fb97645fa15bf86ae7069e0338a91d50e2388d2fb7032da8fc117609bdeb - referenced ·
2b15fb97645fa15bf86ae7069e0338a9· first seen 2026-08-20 - bd551bcf712734ec3228165e2745f34e6ded5e1a14b12c22a067d4f6fbb1a9ed - referenced ·
bd551bcf712734ec3228165e2745f34e· first seen 2026-08-20
Antivirus & YARA (0 of 47 engines)
No engine flagged this page's content.
Categories
- credential-harvest
Why this verdict
- Credential-harvesting form
- Valid TLS, no impersonation or off-origin credential post
Contacted infrastructure
- 157.240.8.35 - AS32934 Facebook, Inc. (Australia)
- 157.240.8.23 - AS32934 Facebook, Inc. (Australia)
Observed indicators
- www.facebook.com
- static.xx.fbcdn.net
- en-gb.facebook.com
- l.facebook.com
- developers.facebook.com
- 157.240.8.35
- 157.240.8.23
- https://www.facebook.com/
- https://static.xx.fbcdn.net/rsrc.php/y1/r/ay1hV6OlegS.ico
- https://en-gb.facebook.com/
- https://static.xx.fbcdn.net/rsrc.php/v5/y3/l/0,cross/aelxQiRq4w1EU4T_aHxuwqxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1.css
- https://www.facebook.com/recover/initiate/?privacy_mutation_token=eyJ0eXBlIjo1LCJjcmVhdGlvbl90aW1lIjoxNzg3MjY0MjQzfQ%3D%3D&ars=facebook_login
- https://www.facebook.com/reg/?entry_point=login
- https://www.facebook.com/reg/
- https://www.facebook.com/login/
- https://l.facebook.com/l.php?u=https%3A%2F%2Fmessenger.com%2F&h=AUBKCqiDXsExSl_FRc5QfCJjngR01LaTRj_jgtP2Preaqw3c3NX1pQeoMZ1waqd4AC6y-groPM5o1y7n-F2FqlDqCucTLSUVFjX70h5am8PigFjyU3PTRTFZ9L0K-LLgVlcb2kc451s3yAt6
- https://www.facebook.com/lite/
- https://www.facebook.com/watch/
- https://l.facebook.com/l.php?u=https%3A%2F%2Fabout.meta.com%2Ftechnologies%2Fmeta-pay&h=AUBKCqiDXsExSl_FRc5QfCJjngR01LaTRj_jgtP2Preaqw3c3NX1pQeoMZ1waqd4AC6y-groPM5o1y7n-F2FqlDqCucTLSUVFjX70h5am8PigFjyU3PTRTFZ9L0K-LLgVlcb2kc451s3yAt6
- https://l.facebook.com/l.php?u=https%3A%2F%2Fwww.meta.com%2F&h=AUBKCqiDXsExSl_FRc5QfCJjngR01LaTRj_jgtP2Preaqw3c3NX1pQeoMZ1waqd4AC6y-groPM5o1y7n-F2FqlDqCucTLSUVFjX70h5am8PigFjyU3PTRTFZ9L0K-LLgVlcb2kc451s3yAt6
Other scans of www.facebook.com (10)
This host has been scanned before. Each scan is a separate observation, so a verdict here does not carry over to the others.
- 24 Aug 2026 - benign
- 24 Aug 2026 - unknown ·
https://latincanada.ca/argentina-vencio-2-1-nigeria-y-se-clasifico-octavos-con-la-derrota-de-islandi - 24 Aug 2026 - unknown ·
https://s.ai/ - 24 Aug 2026 - unknown ·
https://climatechangeconferences.com/ - 24 Aug 2026 - suspicious ·
https://seeandhearbetter.ie/img/shop//contents/97369378376.pdf - 24 Aug 2026 - unknown ·
http://lolmaner.blogspot.com/2013/04/how-to-make-guy-your-boyfriend.html - 24 Aug 2026 - unknown ·
https://au.norton.com/ - 24 Aug 2026 - unknown ·
https://au.norton.com/ - 24 Aug 2026 - unknown ·
http://phimhddd.blogspot.com/search/label/M%C3%83%C2%83%C3%82%C2%83%C3%83%C2%82%C3%82%C2%83%C3%83%C2 - 24 Aug 2026 - unknown ·
https://hypoteky-reality-zilina.sk/novy/ckfinder/userfiles/files/zudagoxakejeletiramuketez.pdf
Questions about www.facebook.com
- Is www.facebook.com safe?
- The scan of www.facebook.com on 20 Aug 2026 found no evidence of harm. That is the absence of a finding at one point in time, not a guarantee: a page can change, and a scan only sees what it was served.
- What malware is associated with www.facebook.com?
- 106 analysed samples communicate with this URL, including Fileinfector.
- How was www.facebook.com checked?
- A static pass resolved DNS, captured TLS and headers and followed the redirect chain, and where the fast tier allows, a headless browser rendered the page and recorded every request. Egress is SSRF-locked. Signatures that matched only page text are weighted far below one that matched a served file, because a page documenting malware matches the same rules.
Scanned at the fast tier - see how URL scanning works.
Scan another URL · Latest analyzed threats · All scans of www.facebook.com
Scanned on MalwareAnalyzer by Cyble · Open interactive scan