Sophos Cloud Optix
This morning people began receiving messages in their Facebook inbox with a subject of “Look at this!” and a message body containing a simple link pointing you to fbstarter.com. Yesterday we saw a similar looking domain attempting to phish peoples information on the domain fbaction.net. According to Google Trends, “fbstarter.com” is currently the #1 hottest topic on Google right now. In fact, it’s also the #11 as “fb starter” and #21 as “www.fbstarter.com”.
The domain was just registered today, and at the time of publishing this blog it doesn’t seem to resolve to anything and thus isn’t hosting any content. We suspect that at some point today it will be hosting a Facebook phish site in an attempt to steal your login information.