facebooklogin17[.]blogspot[.]com

This domain, facebooklogin17.blogspot.com, is flagged as an active credential phishing site as of July 31, 2026. The domain is registered through Google LLC and has been identified by multiple security platforms. It appears on two security blocklists: PhishDestroy and Phishunt, indicating ongoing malicious activity. The domain resolves to the IP address 142.251.127.132, which is associated with Google's infrastructure.

However, the nameservers for this domain are not found, which could suggest recent changes or attempts to evade detection. According to VirusTotal, 20 out of 91 security vendors have flagged this domain as malicious, highlighting a significant risk level. Despite this, the domain remains active, posing a threat to users who may unsuspectingly provide their credentials. Infrastructure analysis reveals that the domain is hosted on a reputable platform, but the lack of nameservers and the presence on multiple blocklists are concerning indicators.

Defenders should monitor this domain closely and consider blocking it to prevent potential credential theft. The exact content of the site has not yet been analyzed, but the high risk of credential phishing is evident from the available intelligence. Security teams are advised to educate users on the signs of phishing and to implement additional layers of authentication to protect against credential theft.