app101-facebook[.]blogspot[.]com

This domain is flagged as a high-risk phishing site specifically designed to impersonate Facebook login pages. Analysis indicates the threat type is a credential harvesting scheme, targeting users through fake authentication portals to capture sensitive account details. The domain leverages social engineering tactics, presenting itself as a legitimate Facebook service to deceive victims into entering their credentials. Infrastructure analysis reveals the domain is registered through Google Blogger, a platform frequently abused for phishing due to its free hosting and ease of deployment. VirusTotal detection shows 10 out of 95 security vendors have flagged this domain as malicious, indicating moderate but concerning consensus. The domain resolves to the IP address 142.251.13.132, which is associated with Google’s infrastructure, further complicating attribution. No specific creation date is publicly available due to Blogger’s hosting model, but the domain remains actively serving phishing content as of the latest verification. Blocklist status varies across threat intelligence feeds, with some platforms yet to classify it, underscoring the need for proactive monitoring. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing the domain, particularly in environments where Facebook credentials may be reused for corporate services. End-user education should emphasize verifying URLs before entering credentials, especially for domains hosted on third-party platforms like Blogger. Security teams are advised to monitor for compromised accounts linked to this domain and enforce multi-factor authentication to mitigate the impact of credential theft.