facebookloginpage1[.]blogspot[.]com

Analysis as of July 26 2026 indicates that facebookloginpage1.blogspot.com is actively used for credential phishing. The domain is hosted on Google’s Blogger platform, as evidenced by the registrar entry Google LLC. DNS resolution points to IP address 142.250.154.132, which belongs to Google’s infrastructure and is shared by many legitimate Blogger sites, reducing the usefulness of IP‑based blocking alone. VirusTotal records show that 22 of 91 scanned security engines have flagged the domain, demonstrating a high detection rate among industry scanners. The domain also appears on three independent phishing blocklists—PhishDestroy, OpenPhish, and Phishunt—confirming that multiple threat‑intelligence feeds consider it malicious. Nameserver information could not be retrieved, which may be a result of the dynamic nature of Blogger’s DNS configuration.

The combination of a high vendor detection count, inclusion on multiple blocklists, and the fact that the domain is still active suggests a sustained phishing campaign targeting users of the Facebook login page. However, public evidence does not include a snapshot of the landing page, SSL certificate details, HTTP response codes, or any observed credential harvesting behavior, leaving the exact phishing vector and victim acquisition methods uncertain. Given the high vendor detection ratio, the domain should be assigned a high risk rating in security policies. Organizations that enforce strict email filtering should flag any messages containing this URL as malicious.

Incident response teams should consider the domain when investigating reports of compromised Facebook credentials and should collect any logs that show connections to the IP address 142.250.154.132. Because the domain resides on a shared hosting environment, blocking the IP may affect unrelated legitimate Blogger sites; therefore, URL‑level blocking is preferred.