Facebook Hit With Mobile Phone Number Phishing Scam

Today I saw a post from a friend on Facebook touting a new feature. Their wall post read:

“Hey check this new facebook feature out, i got my own mobile number. go to www.fb-mobile.com to get it.”

Forty minutes later I found out their account had been hacked.

A quick whois on the above domain shows the url (www.fb-mobile.com) is registered to JIANGSU BANGNING SCIENCE & TECHNOLOGY CO. LTD and it was registered just two days ago on 8/9/2010. Not very Facebookesque I would say.

Let this serve as a good reminder for Facebook users to never enter your username and password outside of the Facebook homepage. Note that the URL in the quote above, which leads to what looks like a Facebook sign in page, is not Facebook. So if you visit the site (don’t), DO NOT enter your Facebook credentials or any other personal information.

Only your friends can add Wall posts on Facebook, so any posts linking to phishing sites are either from hacked accounts or else people have added the phishers as a friend.

This is a good candidate for PhishTank, an anti-phishing service created by OpenDNS.