loginfacebooklogin[.]blogspot[.]com

The subdomain loginfacebooklogin.blogspot.com is currently active and has been identified as a credential phishing vector. Registration details show the domain was created through Google LLC, indicating it resides on a legitimate blogging platform. Network resolution points to the IP address 142.251.20.132, which belongs to Google's infrastructure, a common characteristic for abused blogspot hosts. VirusTotal analysis records eight detections out of ninety‑one scanners, confirming that multiple security engines have flagged the domain for malicious behavior. Independent threat‑intelligence feeds list the domain on a single security blocklist, and the commercial phishing mitigation service PhishDestroy reports it as blocked, reinforcing the consensus that the site is being used for phishing. Nameserver information is unavailable (NS_NOT_FOUND), limiting deeper DNS‑level attribution. No public SSL certificate details, HTTP response codes, or page title metadata have been disclosed, leaving the exact content of the landing page unverified. The primary uncertainty revolves around the specific phishing payload and any credential harvesting mechanisms employed; no sample URLs or page screenshots have been shared. Defenders should treat the domain as high‑risk, enforce network‑level blocks for the resolved IP, add the host to URL filtering policies, and monitor for similar blogspot subdomains that incorporate brand‑related keywords. Continuous re‑scanning with multi‑engine services is recommended to capture any evolution in the site’s behavior, and incident response teams should be prepared to respond to potential credential theft targeting Facebook accounts.