tomarpicdako[.]blogspot[.]com

The domain tomarpicdako.blogspot.com is flagged for brand impersonation, specifically mimicking Facebook, and is currently offline. This domain poses an elevated risk to users who may be tricked into entering their Facebook credentials on a fraudulent login page.

Analysis indicates that tomarpicdako.blogspot.com was flagged by 17 of 95 VirusTotal vendors, suggesting that the domain has been actively used for phishing attempts. The domain is registered through MarkMonitor, Inc., a company often used by legitimate brands to manage their online presence, which may lend an air of credibility to the impersonation. The domain resolves to an IP address 142.250.184.193, located in the United States and associated with AS15169 Google LLC. The SSL certificate is issued by Google Trust Services / WE2, which is unusual for a phishing domain. The domain was created on July 31, 2000, and has been listed on 1 security blocklist, further indicating its malicious nature. The page title 'Log in to Facebook | Facebook' is a clear attempt to mimic the official Facebook login page, making it more convincing to potential victims.

Currently, the domain is taken offline, which reduces the immediate threat. However, it is recommended that organizations and individuals continue to monitor for any resurfacing of this domain. The domain should be added to internal blocklists and users should be educated about the importance of verifying the URL before entering any sensitive information. Additionally, network administrators should implement DNS filtering to prevent access to this domain and similar ones, even if they are temporarily offline.