facebook-login-it[.]blogspot[.]com

The domain facebook-login-it.blogspot.com is currently active and is classified as a credential phishing infrastructure. Registration records show the subdomain was created through Google LLC, indicating that the hosting provider is the public Blogger platform. DNS resolution points to the address 142.251.14.132, an IP address associated with Google’s global infrastructure, and the nameserver query returned no records (NS_NOT_FOUND), which is consistent with the dynamic DNS handling employed by the Blogger service. VirusTotal analysis reports that 12 of 91 security vendors flag the domain as malicious, providing a moderate level of vendor consensus on its threat status.

Independent phishing‑specific blocklists have already taken action: PhishDestroy, OpenPhish, and Phishunt all list the domain as blocked, and the domain appears on three additional security blocklists, reinforcing the assessment of malicious intent. The available intelligence does not include a page title, SSL certificate details, or HTTP response codes, leaving the exact content and visual presentation of the site unverified. Consequently, analysts cannot confirm which specific Facebook login page elements are being spoofed, but the presence of the keyword “login” in the subdomain suggests an attempt to harvest user credentials. Defensive teams should immediately add facebook-login-it.blogspot.com to URL filtering policies and block it at network perimeter devices.

Continuous monitoring of DNS queries for the associated IP address is advised, as the IP may host additional malicious subdomains in the future. Sharing the indicator set—including the domain name, resolving IP, and blocklist references—with threat‑intelligence platforms will improve collective detection capabilities.