facebooklende[.]blogspot[.]com

Analysis of facebooklende.blogspot.com confirms it as an active phishing domain targeting Facebook users. Registered on January 31, 2026, through Google Blogger, the domain resolves to IP 172.217.16.161 (Germany, Google LLC) and presents a page titled 'Facebook,' directly aligning with the brand impersonation classification. The site returns an HTTP 200 status, indicating full operational capacity, and employs technologies including Blogger, Java, Python, OpenGSE, Google AdSense, and HTTP/3. Infrastructure analysis reveals the use of a Google Trust Services SSL certificate (WE2), further embedding it within legitimate service providers to evade detection. Security vendor assessments flag the domain as malicious, with 19 of 91 engines on VirusTotal detecting it as phishing. It appears on one security blocklist and is explicitly blocked by PhishDestroy, corroborating its classification as a social media phishing threat. The Gridinsoft trust score of 0/100 reinforces the high-risk designation. While the exact phishing mechanics remain unconfirmed due to lack of page content analysis, the combination of brand impersonation, active status, and detection by multiple security layers confirms its malicious intent. Defenders should prioritize blocking the domain at DNS and network levels, particularly in environments where Facebook credentials are critical. Monitoring for associated IPs (172.217.16.161) and SSL certificates (Google Trust Services WE2) may aid in identifying related infrastructure. Given the domain's hosting on Blogger, takedown requests should be directed through Google's abuse reporting channels. No evidence suggests compromise of legitimate user accounts at this stage, but credential harvesting remains the likely objective.