facebook-blog-com[.]blogspot[.]be

This domain, facebook-blog-com.blogspot.be, is confirmed as a brand impersonation phishing site targeting Facebook users. Analysis indicates the infrastructure was designed to mimic Facebook’s official blog or support pages, as evidenced by the page title "Facebook" and the use of a subdomain under blogspot.be, a legitimate Google-hosted platform. The domain does not appear to be associated with a known drainer kit but leverages social engineering to deceive victims into divulging credentials or other sensitive information. Infrastructure analysis reveals the domain resolved to IP address 142.250.185.97, registered under Google LLC (AS15169). The SSL certificate was issued by Google Trust Services (WE2), a common practice for malicious actors exploiting legitimate hosting providers. At the time of detection, 12 out of 95 security vendors on VirusTotal flagged the domain as malicious. The domain was listed on two security blocklists, including PhishDestroy and PhishingDB, and was hosted on Google’s Blogspot platform, which is frequently abused for phishing campaigns due to its accessibility and perceived legitimacy. The domain is currently offline, reducing immediate risk to end users. However, the infrastructure’s prior use of a trusted hosting provider and SSL certificate underscores the need for continued monitoring. Organizations should ensure endpoint protection systems are updated to block similar domains, particularly those leveraging subdomains of legitimate platforms. Users are advised to verify the authenticity of any Facebook-related communications by cross-referencing with official channels and inspecting URL structures for anomalies.