Last updated on February 5th, 2024 at 03:26 am
There were multiple reports on r/scams yesterday of fraudulent Facebook messages being sent to users with Facebook Business accounts. The messages claim the recipients have violated Facebook’s intellectual property policies and that their pages will be deleted unless they click a link to a non-official site. Users should not click the links, however, as they are malicious.
Fake messages
The scam messages are being sent from accounts with names of the form “Guest 4601,” and warn users “Your Facebook page will be permanently deleted due to a post that violates our trademark rights.” Recipients are then instructed to “submit a complaint requesting a restoration of this page before it is removed from Facebook,” by clicking a malicious link.
Two different scam domains were used in the messages posted on Reddit: fbpage-notifications[.]com and notice-pages[.]com (I have put square brackets around the dots to prevent anyone from accidentally visiting these malicious sites.) Both domains were registered on January 15th, the same day the messages were sent.
When I visited the malicious URLs using Any Run, an online virtual sandbox, I found both sites were identical and asked for the user’s name, email, birth date and phone number, and had space for them to write their appeal.
I reported both domains to the registrar, Network Solutions, for phishing but as of the time of writing, they remain operational and they were terminated for fraudulent activity on January 18th.
The takeaway
If you receive a Facebook message warning your page will be deleted for trademark infringement unless you click a link, don’t click the link! Instead, block the sender and delete the message.
