facebook-calls[.]blogspot[.]com

Analysis as of July 22, 2026 shows that the domain facebook-calls.blogspot.com is actively hosting a brand‑impersonation campaign targeting Facebook. The site is registered through Google Blogger and resolves to the Google‑owned IP address 142.251.20.132, which is geolocated to the United States and associated with Google LLC. The TLS certificate presented by the site is issued by Google Trust Services under the WE2 hierarchy, indicating a valid HTTPS connection but offering no assurance of legitimacy. HTTP requests return a 200 status code, and the page title is simply "facebook," confirming that the domain name and title are aligned with the claimed brand target. Technical fingerprints reveal the presence of Blogger, Java, Python, OpenGSE, Google AdSense, and HTTP/3, consistent with a typical Blogger‑hosted site that may be leveraged to serve malicious content or advertisements.

VirusTotal has recorded 10 detections out of 91 scanned security vendors, demonstrating that a subset of threat intelligence engines have flagged the domain as malicious. Independent blocklists, including PhishDestroy and Phishunt, have already listed the domain, and it appears on two additional security blocklists, reinforcing its classification as high‑risk. The domain’s nameserver information is unavailable (NS_NOT_FOUND), limiting the ability to trace upstream DNS infrastructure.

While the available data confirm active impersonation of Facebook and a high risk rating, the exact payload or credential‑collection mechanisms employed by the site remain unverified, as no detailed page content analysis is provided. Defenders should therefore treat the domain as hostile: block it at perimeter firewalls, DNS resolvers, and web proxies; add it to internal URL filtering and threat‑intel feeds; and monitor for any outbound connections to the associated IP address.