Trust Report Canada · November 2026
You list something on Facebook Marketplace. A few minutes later, a message arrives:
The message Mike received in April 2025 while selling a guitar. The blur is his.
It looks like a buyer with something to trade. The link even contains words from your own listing. Here’s what was on the other end.
1. A copy of the Facebook login page
The link opened a page that looked like Facebook’s login screen. It wasn’t on facebook.com. It was on a free website address under atwebpages.com, a free web hosting service, and the browser marked it “Not secure”.
The page in April 2025. The tab says “See the advert now”; the form asks for your Facebook login.
2. Your details went into a public file
Whatever someone typed into that form was saved to a plain text file on the same website. Anyone who knew the file’s name could read it. When Mike looked, it already held real email addresses and passwords, typed in from phones that evening, inside Facebook’s own app.
The first entry was different: the email “test” and the password “123”, sent from a home internet connection in the United States. That’s what it looks like when someone tries their own form before sending the link out.
3. It was gone the same night
Within two hours of the message, the page was swapped for links to gift-card offers, and then the site returned “403 Forbidden”. Mike sent what he had collected to law enforcement that night.
What we found in November 2026
We re-checked on November 10, 2026.
- The free host is still running. atwebpages.com was first registered in 2007 and is registered until 2027. Public website scanners have recorded 123 pages under it in the past four weeks.
- The registrar is the same. atwebpages.com is still registered through eNom, whose abuse inbox has blocked Mike’s automated reports in the past.
- The original page can’t be re-checked. Its full address wasn’t kept after the evidence was sent to police, so we can’t say whether it ever came back.
What we checked
| Claim | Observation | Source | Captured |
|---|---|---|---|
| A buyer’s “listing” | The link led to a copy of the Facebook login page on a free hosting address, not to Facebook | Mike’s 2025 observation | 2025-04-22 |
| A login form | Entered details were written to a text file anyone could read on the same site | Mike’s 2025 observation | 2025-04-22 |
| atwebpages.com, the host | Registered 2007, expires 2027, registrar eNom | RDAP, Verisign | 2026-11-11 |
| atwebpages.com, current use | 123 pages recorded by a public scanner between October 15 and November 10, 2026 | urlscan.io | 2026-11-11 |
| The April 2025 page | Not re-checked: its full address wasn’t kept | n/a | n/a |
What to do
- Never log in from a link in a message. If a buyer wants you to see something, open Facebook yourself and look there.
- Check the address bar. Facebook’s login page is on facebook.com. Anything else, however familiar it looks, is not Facebook.
- Already typed your password in? Change it now, from the Facebook app or facebook.com, turn on two-factor authentication, and check Settings, then Password and security, then Where you’re logged in, for devices you don’t recognise.
- Report the message on Facebook: open the chat, tap the name, and choose Report.
- Lost money or access? Report it to the Canadian Anti-Fraud Centre and your local police, and tell us at [email protected].
The evening, minute by minute, is written up by Mike: Wright (2025), his account of the April 2025 page.