tt-facebook[.]blogspot[.]com

The domain tt-facebook.blogspot.com is currently active and engaged in credential theft through brand impersonation, specifically targeting Facebook users. Analysis indicates this infrastructure is designed to harvest login credentials by mimicking the legitimate Facebook platform, as evidenced by the page title 'facebook' and the domain structure. The site remains operational and poses a significant risk to users who may unknowingly submit sensitive account information. Infrastructure analysis reveals that tt-facebook.blogspot.com is hosted on Google Blogger, a common platform exploited for phishing due to its accessibility and trust associations. The domain resolves to the IP address 142.250.154.132, which is not inherently malicious but serves as a conduit for the phishing content. According to VirusTotal, 12 of 95 security vendors have flagged this domain as malicious, a notable detection rate that underscores its threat level. No additional historical data, such as registration date or blocklist counts beyond VirusTotal, is currently available for this subdomain, as it is dynamically generated under the Blogger service. The current status of tt-facebook.blogspot.com is active, and users are advised to exercise extreme caution. Any interaction with this domain, particularly entering login credentials, should be avoided. Organizations and individuals are recommended to block access to this domain at the network level and report it to relevant security teams for further mitigation. Users who may have already interacted with the site should immediately change their Facebook passwords, enable multi-factor authentication, and monitor their accounts for unauthorized activity. Security teams should treat this domain as part of a broader credential theft campaign and investigate potential lateral movement or follow-on attacks originating from compromised accounts.