app72-facebook[.]blogspot[.]com

This domain, app72-facebook.blogspot.com, is identified as an active credential theft phishing site specifically targeting Facebook users. Analysis indicates the infrastructure is designed to harvest login credentials by impersonating the Facebook brand through deceptive subdomains and page content. The domain remains operational, posing a high risk to unsuspecting users attempting to access their accounts via fraudulent links. Infrastructure analysis reveals the domain is hosted on Google Blogger, a common platform exploited for phishing due to its free hosting and ease of setup. It currently resolves to the IP address 142.251.127.132, which is associated with legitimate Google services but has been abused for malicious purposes. As of the latest scan, 10 of 95 security vendors on VirusTotal have flagged this domain as malicious, indicating a moderate but concerning level of detection. No historical registration data is available due to the use of a subdomain under Blogspot, which obscures traditional WHOIS records. The lack of blocklist prevalence suggests this is a relatively new or low-volume campaign, but the active status and targeted impersonation of Facebook elevate its risk profile. The domain remains active and continues to host credential theft pages, as verified through recent scans. Users are strongly advised to avoid interacting with this domain or any links directing to it. Organizations should implement network-level blocks for app72-facebook.blogspot.com and monitor for related subdomains under the Blogspot infrastructure. End-users who may have entered credentials on this site should immediately change their Facebook passwords, enable multi-factor authentication, and review their accounts for unauthorized activity. Security teams are recommended to inspect proxy logs for connections to 142.251.127.132 or the domain name to identify potential compromises.