Phishing detection: facebook-sa.blogspot.com

Facebook
https://facebook-sa.blogspot.com Access site
Screenshot
Screenshot of facebook-sa.blogspot.com
Investigate
Domain facebook-sa.blogspot.com0 CT hosts on apex
urlscan page.domain VirusTotal Whois
IP 142.251.20.132
urlscan page.ip VirusTotal ipinfo Greynoise
URL https://facebook-sa.blogspot.com
urlscan Wayback archive.today
Cert WE2
crt.sh Censys Google CT
Phishunt analysis Beta
33 medium suspicion suspiciousheuristic risk score · not a probability
Why?
  • +5.3 Keyword match
  • +5.1 Site cluster
  • +4.5 Brand in title
  • +3.7 Brand in domain label
  • +3.0 OpenPhish
  • +2.3 Cert reuse
  • +2.2 Country mismatch
  • +1.7 Shared IP cluster
  • +1.1 ASN reputation
  • +1.1 No CSP header
  • +1.1 No HSTS header
  • +0.6 Suspicious TLD
  • +0.5 Young certificate
  • +0.5 Long domain
  • +0.3 Free CA
  • +0.2 Obfuscated JavaScript
  • +0.1 Hyphens
  • +0.1 External scripts
  • +0.1 Deep subdomain
22 signals fired · detector v3.0.0
AI analysis AIBeta
Credential harvesting

A free Blogger subdomain carries Facebook branding in its name and title, impersonating the platform to capture account credentials. It uses obfuscated JavaScript, is hosted on Google infrastructure and is listed by OpenPhish.

Brand in domain labelBrand in titleOpenPhish
AI-generated from stored detector signals - the AI never visited the site. · 2026-10-27 · confidence 75%
Domain & Network
Whois
Registrar MarkMonitor Inc.
Network
IP 142.251.20.132 Google services
Country GermanyGermany
Hosting Google LLC
ASN AS15169
TLS Cert WE2
External detection OpenPhish
CleanGoogle Safe Browsing · PhishTank · TweetFeed · urlscan.io
Report this phishing
PaaS platform Blogger
Web form
Network / ASN Google LLC
Web form
Registrar MarkMonitor Inc.
abusecomplaints@markmonitor.com
Submit to blocklists
Google Safe Browsing Microsoft SmartScreen APWG PhishTank
Not phishing? Dispute this detection

Tracked from 2026-10-27 13:02 UTC  ·  Last refreshed 2026-10-29 05:30 UTC