123-facebook[.]blogspot[.]com

Analysis indicates that the subdomain 123-facebook.blogspot.com is currently active and resolves to the IP address 142.251.14.132, which belongs to Google’s infrastructure. The domain registration is handled by Google LLC, confirming that the hosting provider is the same entity that operates the Blogspot service. VirusTotal reports that three out of ninety‑one scanning engines have flagged the domain, suggesting that at least a minority of security products have observed malicious characteristics associated with the site.

The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, reinforcing its classification as a phishing vector. Nameserver information could not be retrieved (NS_NOT_FOUND), which limits the ability to assess DNS‑level controls such as DNSSEC or secondary name servers. No additional intelligence such as Safe Browsing verdicts, Open Threat Exchange records, or SSL certificate details is available in the current dataset, leaving the exact content of the landing page unverified.

The limited evidence points to a generic phishing campaign that likely attempts to harvest credentials by leveraging the familiar “facebook” keyword within a legitimate Blogspot URL. Defenders should continue to enforce URL filtering for the exact subdomain, consider adding the IP address to network‑level deny lists, and monitor for any new detections from additional scanning engines. Ongoing collection of page‑level metadata, HTTP response codes, and TLS certificate information is recommended to refine the risk profile and to support automated takedown requests if the site is confirmed to host credential‑stealing forms.