starx41017[.]blogspot[.]com

This domain, starx41017.blogspot.com, is confirmed to operate as a credential harvesting site specifically impersonating Facebook login pages. Analysis of the page title, 'Facebook - Log In or Sign Up,' indicates an attempt to deceive users into submitting valid authentication credentials, which are then captured by threat actors for unauthorized account access or further malicious activity. The domain poses an elevated risk due to its direct targeting of a high-value brand and the use of social engineering tactics to exploit user trust in official login interfaces. Infrastructure analysis reveals multiple technical indicators supporting this classification. The domain resolves to IP address 216.58.206.33, hosted on autonomous system AS15169 (Google LLC) in Germany. It is flagged by 19 out of 95 security vendors on VirusTotal, with one active entry on a security blocklist. The domain was registered through MarkMonitor, Inc. on March 06, 2026, and uses an SSL certificate issued by Google Trust Services (WE2). Despite its recent creation date, the site has been taken offline following detection by security systems, including PhishDestroy. Users who accessed starx41017.blogspot.com or entered credentials on any page resembling a Facebook login should assume compromise. Immediate actions include resetting passwords for Facebook and any accounts where identical credentials were reused. Enable multi-factor authentication on all critical accounts to mitigate unauthorized access. Monitor financial and communication platforms for signs of fraudulent activity, such as unauthorized logins or messages sent from the account. If credentials were submitted, consider revoking active sessions and reviewing connected third-party applications for suspicious permissions. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts.