facebook-hack-accounts[.]blogspot[.]com

Analysis conducted on July 25, 2026 identifies facebook-hack-accounts.blogspot.com as an active credential-phishing infrastructure. The domain resolves to IP address 142.251.110.132, which belongs to Google’s hosting range, a pattern commonly used by threat actors to benefit from reputable infrastructure and evade simple reputation checks. Registration data shows the domain was created through Google LLC, confirming the use of a legitimate registrar. DNS queries return no nameserver information (NS_NOT_FOUND), indicating either a misconfiguration or an attempt to obscure resolver data.

The domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy feed, demonstrating that at least one defensive vendor has observed malicious activity associated with the host. VirusTotal records indicate that the URL has been scanned by 91 AV engines, none of which flagged the content at the time of scanning; the lack of detections does not constitute evidence of benign intent and may reflect evasion techniques or limited coverage. No additional intelligence such as page title, SSL certificate details, or HTTP response codes is available, leaving the exact content of the site unverified.

Given the domain name’s inclusion of “facebook-hack-accounts,” the most probable objective is to lure Facebook users into submitting credentials, a classic credential-phishing scenario. Defenders should add the domain to web-filter deny lists, monitor DNS traffic for queries to the associated IP, and educate end-users to avoid unsolicited login requests that redirect to blogspot URLs. Continuous re-scanning with multi-engine services and periodic checks against emerging blocklists are recommended to detect any future changes in the domain’s behavior.