facebook-verify[.]blogspot[.]com

Analysis of facebook-verify.blogspot.com indicates that the domain is actively used for credential phishing targeting Facebook users. The site is registered through Google LLC, and its DNS resolution points to the IP address 142.251.14.132. Both PhishDestroy and Phishunt have added the domain to their blocklists, and it appears on two additional security blocklists, confirming that multiple threat intelligence feeds recognize it as malicious. VirusTotal scans show that 14 out of 91 security vendors have flagged the domain, reinforcing the high‑risk assessment.

The domain’s nameserver information could not be retrieved (NS_NOT_FOUND), which may hinder rapid takedown efforts but also suggests the use of dynamic or obscured DNS configurations. No public page title or SSL certificate details have been published, and HTTP response codes have not been disclosed, leaving the exact surface of the phishing page unverified. Despite these gaps, the convergence of blocklist entries, vendor detections, and the IP association with a known Google‑hosted address provides sufficient evidence for defensive action.

Defenders should immediately block the domain at network perimeter devices, update URL filtering rules, and add the associated IP to deny lists. Continuous monitoring of the IP address and any future DNS changes is advised, as the infrastructure could be repurposed for additional campaigns. Threat intel platforms should be updated to reflect the active status and high risk rating, and incident response teams should treat any credential submissions to this domain as compromised, prompting credential resets for affected Facebook accounts.