rn-facebook[.]blogspot[.]com

This domain is flagged for elevated risk due to targeted Facebook credential phishing. Analysis indicates the infrastructure was designed to impersonate Facebook login pages, tricking users into submitting account credentials to unauthorized parties. The threat type is classified as brand impersonation with a focus on credential harvesting, a common tactic in account takeover schemes. Infrastructure analysis reveals the domain rn-facebook.blogspot.com was registered through Google Blogger, a platform frequently abused for phishing due to its free hosting and legitimate reputation. The domain resolves to the IP address 142.251.141.97, located in the United States and associated with Google LLC. Security vendors on VirusTotal detected the domain, with 17 out of 95 flagging it as malicious. The page title, 'Facebook Iogin,' contains a typographical error ('Iogin' instead of 'Login'), a common red flag in phishing attempts. The domain appears on one security blocklist and is currently offline, though its prior activity remains a concern for historical exposure. Mitigation steps for this specific threat type include immediate user education on identifying credential phishing attempts, particularly those hosted on free blogging platforms. Organizations should implement multi-factor authentication (MFA) to reduce the impact of credential theft. Network-level protections, such as blocking known phishing domains at the DNS or proxy level, are recommended. Security teams should monitor for indicators of compromise, including the domain, IP address, and any associated hashes or artifacts. Given the domain's prior activity, affected users should be advised to reset passwords and review account activity for unauthorized access.