grawagorden[.]blogspot[.]com

This domain, grawagorden.blogspot.com, is a confirmed phishing site hosted on Google's Blogspot platform. Analysis indicates the domain is currently active as of July 23, 2026, resolving to IP address 142.251.110.132, which is associated with Google LLC infrastructure. The domain appears on one security blocklist, specifically PhishDestroy, and is flagged by one of 91 security vendors on VirusTotal, suggesting detection by at least one major security provider. The nameservers are reported as NS_NOT_FOUND, which may indicate an incomplete or misconfigured DNS setup, a common tactic in phishing campaigns to evade tracking or takedown efforts.

Infrastructure analysis reveals the domain is registered through Google LLC, leveraging the free Blogspot service to host malicious content. While the exact phishing target or brand impersonation is not specified in available data, the domain is classified as a generic phishing threat with a high-risk level. Defenders should note that the domain remains active despite blocklist inclusion, indicating potential ongoing malicious activity. The lack of widespread detection (only one vendor flag) may reflect either a new or low-volume campaign, or the use of evasion techniques to avoid broader scrutiny.

Recommended actions include blocking the domain at the DNS or proxy level, monitoring for connections to the resolved IP address (142.251.110.132), and reviewing logs for any user interactions with this domain. Given the hosting on a legitimate platform, defenders should also assess whether other Blogspot subdomains are being abused within their environment. No additional details about the phishing kit, page content, or specific lures are available at this time, so further investigation via sandboxing or manual analysis is advised if deeper context is required.