# Facebook login URL: the real address > Facebook's real sign-in page is on www.facebook.com. How to tell a fake Facebook link from the real one, with examples from 373 live phishing URLs. Canonical: https://www.phishclean.com/official-domains/facebook Last updated: 2026-11-09 Facebook's real sign-in page is on www.facebook.com. If a link takes you anywhere else and asks for your Facebook password, close it. We opened each address below on 9 November 2026. www.facebook.com Facebook signs in at www.facebook.com (m.facebook.com on phones) ## Domains Facebook uses Not a complete list. Each address below can have subdomains in front of it (`www.`, `login.`), and they are still Facebook's. - `facebook.com` - `fb.com` - `facebookmail.com` - `meta.com` ## How to read the address Look at the part between `https://` and the first single `/`. Read it from the right. The real thing ends in `facebook.com` or another domain listed below, with nothing but a dot before it. - `https://login.facebook.com/…` is Facebook: it ends in `.facebook.com`. - `https://facebook.com.account-check.example/…` is not: it ends in `account-check.example`, and Facebook's name at the front is decoration. - `https://facebook-secure-login.example/…` is not: a hyphen makes a different domain, and anyone can register one. Everything after the first `/` is chosen by whoever made the page, so `…/facebook.com/signin` in the path proves nothing. ## What fake Facebook pages looked like On 5 November 2026, PhishTank listed 373 live, verified phishing URLs that its volunteers labelled Facebook. - **98.7%** used HTTPS. The padlock means the connection is encrypted, not that the site is Facebook. - **1.6%** had "facebook" in the hostname. Most fakes give no such clue, so the absence of Facebook's name doesn't make a link safe either. - **81.5%** sat on services anyone can sign up to, such as website builders, file sharing and QR-code links, rather than on a domain the attacker registered. Hostnames from the same list that use Facebook's name without being Facebook's, newest first. Dots are written as `[.]` so none of them is a working link. - autho-facebook-appp[.]weebly[.]com - facebookctf[.]vercel[.]app - facebook[.]market-34545647656[.]club - video-share-facebook[.]weebly[.]com - noreplybusinessfacebook[.]com - facebook-downloader[.]czhyk[.]biz[.]id ## Report a fake Facebook email or page Use the Report option on the post, message or Page inside Facebook. We could not open Meta's help page to confirm an email address, and the one most sites repeat dates from 2012, so we don't print it here. Source: [Facebook Help Center](https://www.facebook.com/help/), checked 9 November 2026. ## Lures to watch for - "Your Page will be removed for a copyright violation" messages are a common lure aimed at Page owners. Check your Page from inside Facebook instead of through the link in the message. - Facebook's real notification emails come from facebookmail.com. A sender name that says "Meta Support" can be set by anyone. Not sure about a link? Paste it into the [free link checker](https://www.phishclean.com/check-link). It reads the address only and doesn't open the page. The [PhishClean browser extension](https://www.phishclean.com/) also checks each page you open for signs of a fake sign-in form. ## Questions ### What is Facebook's official login URL? www.facebook.com (Facebook signs in at www.facebook.com (m.facebook.com on phones)). A real Facebook address ends in facebook.com, fb.com, facebookmail.com or another domain the brand owns, read from the right of the hostname. ### How do I report a fake Facebook email or website? Use the Report option on the post, message or Page inside Facebook. We could not open Meta's help page to confirm an email address, and the one most sites repeat dates from 2012, so we don't print it here. ### Do fake Facebook sites use Facebook's name in the address? In PhishTank's list of live phishing URLs on 5 November 2026, 6 of the 373 URLs labelled Facebook (1.6%) had the brand's name in the hostname, so most gave no such clue. 98.7% used HTTPS, so a padlock proves nothing. ## How we checked - **Sign-in addresses:** opened on 9 November 2026 and followed through every redirect to where the sign-in page loads. - **Phishing numbers:** [PhishTank](https://phishtank.org/)'s online-valid list, downloaded 5 November 2026. Only URLs its volunteers labelled Facebook count, and many fakes are labelled "Other", so these are a sample. We didn't open any of them. Data shared under [CC BY-SA 2.5](https://creativecommons.org/licenses/by-sa/2.5/); method as in our [phishing URL statistics](https://www.phishclean.com/research/phishing-urls). - **Example hostnames:** hostnames in the whole list that contain "facebook" but aren't on Facebook's domains, one per domain. See also: [official sign-in addresses of 15 brands](https://www.phishclean.com/official-domains). Last updated: 9 November 2026, when the sign-in addresses were checked.