facebookmessenger12[.]blogspot[.]com

On July 23, 2026 the domain facebookmessenger12.blogspot.com was identified as a brand‑impersonation site targeting Facebook users. The site is hosted on the Blogger platform, which is confirmed by the presence of the technology stack Java, Python, OpenGSE and HTTP/3. The page title returned by the HTTP request is "Log in to Facebook | Facebook", indicating an attempt to lure victims into a credential‑harvesting flow. The site presents a valid TLS certificate issued by Google Trust Services (WE2), reflecting the underlying Blogger service’s default HTTPS provisioning. DNS resolution points to IP address 192.178.183.132, which belongs to AS15169 (Google LLC) and is geolocated in Germany.

Nameserver data could not be retrieved (NS_NOT_FOUND). HTTP probing returned a 404 status code, and the domain is currently reported as offline, which limits direct content analysis. Reputation data shows the domain appears on a single security blocklist and is flagged by PhishDestroy. VirusTotal analysis recorded 16 detections out of 91 scanning engines, reinforcing the malicious classification.

The domain was registered via Google Blogger, a free‑service registration that often masks the true operator. Uncertainties remain around the specific phishing infrastructure employed (e.g., backend form processing) because the site is not reachable and no payload samples have been captured. Defenders should add the fully qualified domain name to URL filtering rules, monitor for new Blogger subdomains that replicate the "facebookmessenger" naming pattern, and consider enforcing MFA on affected user accounts. Continuous threat‑intel feeds should be consulted for any resurgence of the domain or related indicators, and any inbound connections to the associated Google‑owned IP should be logged for correlation with credential‑theft attempts.