Friday, May 23, 2025
HomePhishingFacebook's New Tool to Detect and Alert Website Owners About Phishing Attacks

Facebook’s New Tool to Detect and Alert Website Owners About Phishing Attacks

Published on

SIEM as a Service

Follow Us on Google News

Phishing is one of the most common problems for Internet Users, hackers find a new innovative method to create believable URL’s to trick users.

Attackers launch innovative phishing attacks to trick the users and to steal sensitive data such as their passwords, credit card numbers, or other sensitive information. It is hard to detect as they use a number of techniques to resemble it like a legitimate domain.

Facebook phishing detection tool developed two years ago and now they expanded the capabilities of the tool to alert users when new certificate issued for phishing domains.

- Advertisement - Google News

When a new certificate appears in the public Certificate Transparency Log the Facebook phishing detection tool analyzes the domains for possible phishing attempts.

Facebook phishing detection tool

If the tool suspects it is a phishing domain then it notifies the subscribers of the legitimate domain by sending email, push, or on-site notifications based on the subscriber preference.

To enable and domain monitoring service and manage your subscriptions visit facebook developers, Developers need to specify the domain name and the alerts they need to specify.

Certificate alerts: Alerts when the new certificate enrolled for the subscribed domain name.

Phishing Alerts: Notifies when the enrolled new certificate seems to be impersonating the
subscribed domain name.

Certificate Transparency aims to remedy these certificate-based threats by making the issuance and existence of SSL certificates open to scrutiny by domain owners, CA, and domain users. The ultimate goal of CT is to defend mis-issuance of certificates.

Facebook phishing detection tool

Open source tools like Phishing catcher also helps in detection of misissued certificates, malicious certificates, and rogue CAs.

We are also extending our Webhook API to help developers easily integrate this new phishing detection feature into their external systems.” reads facebook statement.

If a domain owner receives a notification that a CA issued a certificate for their domain without an explicit request, they will likely want to contact the CA, check that their identity isn’t compromised and take into account revoking the certificate.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

Operation Endgame Crushes DanaBot Malware, Shuts Down 150 C2 Servers and Halts 1,000 Daily Attacks

Operation Endgame II has delivered a devastating strike against DanaBot, a notorious malware that...

Apple XNU Kernel Flaw Enables Attackers to Escalate Privileges

Apple has released urgent security patches addressing CVE-2025-31219, a high-severity vulnerability in its XNU...

Inside LockBit: Data Leak Reveals Leading Affiliates and How They Operate

A massive data leak from the LockBit ransomware group, published on its hijacked leak...

ViciousTrap Hackers Breaches 5,500+ Edge Devices from 50+ Brands, Turns Them into Honeypots

A sophisticated cyber threat actor, dubbed ViciousTrap by Sekoia.io's Threat Detection & Research (TDR)...

Resilience at Scale

Why Application Security is Non-Negotiable

The resilience of your digital infrastructure directly impacts your ability to scale. And yet, application security remains a critical weak link for most organizations.

Application Security is no longer just a defensive play—it’s the cornerstone of cyber resilience and sustainable growth. In this webinar, Karthik Krishnamoorthy (CTO of Indusface) and Phani Deepak Akella (VP of Marketing – Indusface), will share how AI-powered application security can help organizations build resilience by

Discussion points


Protecting at internet scale using AI and behavioral-based DDoS & bot mitigation.
Autonomously discovering external assets and remediating vulnerabilities within 72 hours, enabling secure, confident scaling.
Ensuring 100% application availability through platforms architected for failure resilience.
Eliminating silos with real-time correlation between attack surface and active threats for rapid, accurate mitigation

More like this

Cybercriminals Using Trusted Google Domains to Spread Malicious Code

A sophisticated new malvertising scheme has emerged, transforming trusted e-commerce websites into phishing traps...

Hackers Targets Coinbase Users Targeted in Advanced Social Engineering Hack

Coinbase users have become the prime targets of an intricate social engineering campaign since...

New Phishing Attack Uses AES & Malicious npm Packages to Office 365 Login Credentials

Fortra’s Suspicious Email Analysis (SEA) team uncovered a highly sophisticated phishing campaign targeting Microsoft...