princesleonorvipwebsitesreal[.]blogspot[.]com

The domain princesleonorvipwebsitesreal.blogspot.com is confirmed as a phishing site specializing in brand impersonation, specifically targeting Facebook users. The page, titled 'Princes Leonor Facebook Especial,' was operational under the guise of a themed Facebook promotion but has since been taken offline. Analysis indicates this was a deliberate attempt to deceive users into believing they were interacting with an official Facebook page, likely to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain was registered through Google Blogger and resolved to the IP address 192.178.155.132. Detection metrics show the domain was flagged by 14 of 95 security vendors on VirusTotal, indicating a moderate to high level of consensus regarding its malicious nature. It appears on one security blocklist and holds a trust score of 0/100 according to Gridinsoft. The SSL certificate is issued by Google Trust Services, a common tactic to lend superficial legitimacy to phishing pages. Detected technologies include Blogger, Java, Python, Bootstrap, OpenGSE, Cloudflare, Modernizr, and jQuery, suggesting a layered infrastructure designed to evade detection and enhance scalability. As of the latest assessment, the domain has been taken offline, though residual risks may persist if users were previously exposed. Organizations and individuals are advised to block the IP address 192.178.155.132 at the network level and monitor for any re-emergence of the domain or similar variants under the same registrar. Users who interacted with the site should immediately reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication, and scan affected devices for malware. Security teams should review logs for connections to 192.178.155.132 and correlate with any anomalous authentication attempts.