facebook-loginacc[.]blogspot[.]com

Analysis indicates that the subdomain facebook-loginacc.blogspot.com is currently active and is being used for credential phishing targeting Facebook users. Google Safe Browsing has classified the URL as a social engineering threat, and the domain appears on a security blocklist. Independent threat-intelligence feeds have identified the site on PhishDestroy’s blocklist, confirming that security operators consider it malicious. DNS resolution points to the IP address 142.251.13.132, which belongs to Google’s public infrastructure, consistent with the domain’s registration through Google LLC. The nameserver query returned no records (NS_NOT_FOUND), suggesting either a misconfiguration or that the subdomain relies on default Blogspot DNS handling rather than explicit delegations.

The domain was examined by VirusTotal, where 91 antivirus and URL-reputation engines scanned the site; none returned a detection at the time of analysis. The absence of a detection does not imply legitimacy, especially given the other corroborating indicators. No SSL certificate details, HTTP status codes, or page-title information are available from the current intelligence set, leaving the exact payload and landing-page characteristics unverified.

Defenders should treat facebook-loginacc.blogspot.com as a high-risk credential-harvesting host. Immediate mitigation steps include adding the domain to URL filtering and web-proxy block lists, updating email-gateway phishing rules to flag any messages containing this URL, and monitoring DNS queries for outbound connections to the associated IP address. Continuous re-evaluation is advised, as the hosting provider’s reputation may change and additional analysis (e.g., page content, TLS fingerprint) could surface new indicators.