facebookwebsite9[.]blogspot[.]com

Analysis indicates that facebookwebsite9.blogspot.com is an active phishing domain targeting Facebook credentials. The domain resolves to IP address 142.251.14.132, which is associated with Google LLC infrastructure, consistent with its registration through Blogspot. No valid nameservers were detected, a common indicator of hastily deployed phishing infrastructure. As of August 02, 2026, the domain remains active and is flagged by 9 of 91 security vendors on VirusTotal, with detections including phishing and fraud classifications.

It appears on three security blocklists: PhishDestroy, OpenPhish, and Phishunt, further corroborating its malicious intent. The domain's hosting on Blogspot aligns with observed patterns of threat actors leveraging free subdomain services to evade initial detection. While the exact content of the phishing page is not yet analyzed, the domain name and detection context strongly suggest it is designed to harvest Facebook login credentials. Defenders should treat this domain as high-risk and implement immediate blocking at the DNS, proxy, and endpoint levels.

Network monitoring for connections to 142.251.14.132 or the domain itself is recommended to identify compromised hosts. Given the domain's persistence, security teams should also review logs for prior interactions and assess whether any credentials may have been exposed. No SSL certificate or HTTP status details were provided, limiting further technical assessment of the site's configuration.