The first red flag is the malformed protocol. Standard web addresses use http:// or https:// . Here, we see http- , with a hyphen instead of a colon and slashes.
The pattern is always the same: include "facebook" somewhere in the URL to trick users. http- free.cinyourrc.facebook.com
A user might see this in an email or ad and assume it’s Facebook due to the trailing facebook.com . In reality, the effective domain could be cinyourrc.com (if cinyourrc.facebook.com is a subdomain of cinyourrc.com – impossible because .facebook.com is not a TLD). This suggests the string is likely part of a longer crafted URL: e.g., http://free.cinyourrc.com/facebook.com but rewritten. The first red flag is the malformed protocol
To see photos or watch videos, you typically must switch to "Data Mode," which will then use your paid data balance. The pattern is always the same: include "facebook"
If you see a subject line like this: