Fake Meta / Facebook Websites
56 domains flagged by threat-intelligence feeds for impersonating Meta / Facebook. Most recent listing: May 29, 2026.
Domains Impersonating Meta / Facebook
56 shownHow to spot a fake Meta / Facebook site
- • Check the domain against Meta / Facebook's official address. Look-alike domains add extra words, hyphens, or unusual extensions.
- • Never log in via a link from an email or text. Navigate to the official site directly.
- • Use a password manager — it will not autofill your Meta / Facebook credentials on a look-alike domain.
Frequently Asked Questions
How do I tell a real Meta / Facebook website from a fake one?
Always check the domain in the address bar against Meta / Facebook's official domain. Impersonation sites use look-alike domains (extra words, hyphens, or unusual extensions). Never enter your Meta / Facebook login or payment details on a site you reached from an email or text link — navigate to the official site directly instead.
I entered my Meta / Facebook details on one of these sites. What should I do?
Change your Meta / Facebook password immediately from a device you trust, and change it anywhere you reused it. Enable two-factor authentication. If you entered card or banking details, contact your bank to freeze or reissue the card, and watch your statements for unauthorized charges.
How are these domains identified as impersonating Meta / Facebook?
Each domain on this page was flagged by an upstream threat-intelligence source (URLhaus, OpenPhish, or PhishTank) and contains a Meta / Facebook brand reference in a non-official domain, or was reported by that feed as targeting Meta / Facebook. See our methodology page for full detail.
How do I report a fake Meta / Facebook website?
Report phishing sites to the Anti-Phishing Working Group at reportphishing@apwg.org, to Google Safe Browsing, and to Meta / Facebook's official abuse channel. You can also submit it on RecentScam using the Report button.
Stop the next phishing attack before you click.
NordPass autofill only triggers on real domains. Fake login pages cannot trick it into entering your credentials.