facebook.com

Posture summary

Public attack surface (102 hostnames in Certificate Transparency)

Hostnames this organization published in public TLS certificates. Passive OSINT — nothing was scanned; a wildcard certificate is in use, so the real footprint may be larger.

The hostname inventory — which forgotten hosts exist and where — is part of the complete audit for this domain.

Lookalike domains (55 registered of 80 checked)

Registered permutations of this domain. Existence is a fact, not an accusation — ownership and intent are not assessed. Those able to receive mail are the ones usable for invoice fraud and phishing.

52 further registered lookalike(s), 4 of them able to receive mail. The full list, with mail capability for each, is part of the complete audit.

Recommendations

• mediumEnable DNSSEC

  DNSSEC signing was not detected for this domain.

• highRotate credentials exposed in public breaches

  Public breach records name this domain in 2 reported breach(es), covering approximately 509,535,795 accounts in total; the most recent is dated 2023-10-01. Passwords were among the reported data classes. Enforce a password reset for affected accounts and require MFA.

• highMonitor lookalike domains

  4 registered lookalike domain(s) can receive mail, which is what makes them usable for invoice fraud and credential phishing. Monitor them and consider defensive registrations.

• mediumReview the public subdomain footprint

  102 hostnames for this domain appear in public Certificate Transparency logs. Retire forgotten hosts — stale subdomains are a common entry point and a takeover risk.