Phishing detection: auth.metacreatormonetizationsupportsystem.click

Facebook
https://auth.metacreatormonetizationsupportsystem.click/facebook-10007712493 Access site
Screenshot
No screenshot available yet Captured automatically on the next refresh cycle
Investigate
Domain auth.metacreatormonetizationsupportsystem.click1 CT host on apex
urlscan page.domain VirusTotal Whois
IP 188.114.96.3
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://auth.metacreatormonetizationsupportsystem.click/fac…
urlscan Wayback archive.today
Cert WE1
crt.sh Censys Google CT
Phishunt analysis Beta
38 medium suspicion suspiciousheuristic risk score · not a probability
Keyword matchLong domainHigh entropy
20 signals fired · detector v2.0.0
AI analysis AIBeta
Credential harvesting

Site impersonates a Facebook creator monetization authentication portal on a 4-day-old domain, sharing infrastructure with a known phishing cluster. Uses the brand in the URL path to deceive page owners. Confirmed malicious by OpenPhish.

Brand impersonation in pathYoung domainOpenPhish
AI-generated from stored detector signals - the AI never visited the site. · 2026-08-22 · confidence 75%
Domain & Network
Whois
Registrar Name.com, Inc.
Network
IP 188.114.96.3
Country United StatesUnited States
Hosting Cloudflare, Inc.
ASN AS13335
TLS Cert WE1
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Related infrastructure Betasuspected links from shared infrastructure, not attribution
Suspected cluster #433 · 4 indicators · confidence High · targets: Facebook
app.metacreatormonetizationsupportsystem.click 56 same apex same nameservers similar name registered together same TLS cert shared TLS SAN
active 2026-08-22
center.metacreatormonetizationsupportsystem.click 56 same apex same nameservers similar name registered together same TLS cert shared TLS SAN
active 2026-08-22
fb.metacreatormonetizationsupportsystem.click 56 same apex same nameservers similar name registered together same TLS cert shared TLS SAN
active 2026-08-22
Top 3 of 3 related · rebuilt daily · corr-1.2.0 · related infrastructure API
Campaign
This detection belongs to possible campaign c405bff3c882 (4 members total)
Report this phishing
Network / ASN Cloudflare, Inc.
Web form
Registrar Name.com, Inc.
abuse@name.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-08-22 01:09 UTC  ·  Last refreshed 2026-08-22 07:30 UTC