facebook-login-facebook[.]blogspot[.]com

This domain, facebook-login-facebook.blogspot.com, is identified as a brand impersonation threat targeting Facebook users. Analysis indicates the page mimics Facebook's login interface, as evidenced by the page title 'facebook,' with the objective of harvesting user credentials. No crypto drainer kit signatures were observed, but the domain's structure and content align with credential phishing tactics commonly deployed against social media platforms. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., a registrar frequently associated with legitimate enterprises but occasionally exploited for phishing. The domain resolves to IP address 142.251.141.97, hosted under AS15169 (Google LLC) in the United States. It was created on February 21, 2026, though this date may reflect backdating or registrar data anomalies. Detection metrics show 20 out of 95 security vendors flagged the domain on VirusTotal, while it appears on one security blocklist and is actively blocked by at least one anti-phishing system. The SSL certificate, issued by Google Trust Services (WE2), does not mitigate the domain's malicious intent. As of the latest assessment, facebook-login-facebook.blogspot.com has been taken offline, likely following abuse reports or automated takedown mechanisms. However, the elevated risk persists due to the domain's prior activity and the potential for re-registration or migration to alternative hosting. Users are advised to verify domain authenticity before entering credentials, particularly on platforms hosted under non-corporate subdomains. Organizations should monitor for similar impersonation attempts leveraging blogspot.com or other free hosting services, as these remain prevalent vectors for credential theft campaigns.