facebookloginaccount[.]blogspot[.]com

This domain, facebookloginaccount.blogspot.com, is identified as a credential theft operation targeting Facebook users through brand impersonation. The site replicates the Facebook login interface, tricking victims into submitting account credentials. Analysis indicates no direct association with cryptocurrency drainer kits or other secondary payloads; the primary objective appears to be harvesting login details for unauthorized account access or resale in underground markets. Infrastructure analysis reveals the domain was registered through MarkMonitor, Inc., with a creation date of February 26, 2026, suggesting either a typo-squatting attempt or an error in the reported data, as this date is in the future. The domain resolves to IP address 142.251.143.97, hosted under AS15169 (Google LLC) in the United States. Detection metrics show 19 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one security blocklist. The SSL certificate is issued by Google Trust Services, providing a superficial layer of legitimacy. No detections were reported in Google Safe Browsing at the time of analysis. The domain is currently offline, likely due to takedown actions or suspension by the hosting provider. Despite its inactive status, residual risk persists for users who may have interacted with the site prior to its removal. Organizations are advised to monitor for unauthorized access attempts linked to credentials harvested from this campaign. Users should enable multi-factor authentication on all accounts and verify domain authenticity before entering sensitive information. Continuous vigilance is recommended, as threat actors frequently re-deploy similar infrastructure under new domains.