ml-facebook[.]blogspot[.]com

This domain, ml-facebook.blogspot.com, is actively engaged in credential harvesting through a fake Facebook login portal. Analysis confirms it as a high-risk phishing site designed to impersonate the Facebook brand, tricking users into submitting account credentials. The domain remains operational as of the latest verification. Infrastructure analysis reveals the domain is registered through Google Blogger, a platform frequently exploited for phishing due to its free hosting and ease of setup. It resolves to the IP address 142.251.127.132, which is associated with legitimate Google infrastructure but has been co-opted for malicious use. The page title explicitly mimics Facebook’s branding, displaying 'FACEBOOK' to enhance deception. VirusTotal detections show 9 of 95 security vendors have flagged this domain as malicious, indicating a consensus on its fraudulent nature. No additional blocklist data or creation timestamps were provided, but the domain’s active status and high-risk classification underscore its threat level. The domain remains active and poses an ongoing risk to users. Organizations and individuals are advised to block access to ml-facebook.blogspot.com at the network level and update endpoint protection rules to include this indicator. Users who may have interacted with the site should immediately reset their Facebook credentials and enable multi-factor authentication. Security teams should monitor for related infrastructure, such as similarly named Blogger subdomains, and conduct retrospective log analysis for connections to the IP 142.251.127.132.