facebook-q[.]blogspot[.]com

The domain facebook-q.blogspot.com is currently flagged as a generic phishing site. Registration details show it was created through Google LLC, and the sub‑domain resolves to the IP address 142.251.20.132, which is owned by Google. The name server information is not available (NS_NOT_FOUND), indicating that the domain relies on the default Blogspot infrastructure. Multiple open‑source phishing feeds have listed the domain: PhishDestroy, OpenPhish, and Phishunt all report it as blocked, and three additional security blocklists also contain the entry. VirusTotal analysis shows that eight out of ninety‑five scanning engines have issued a detection, reinforcing the suspicion of malicious use. The site remains active as of the report date, July 22, 2026, and no evidence of takedown or remediation has been observed.

Infrastructure analysis suggests the attacker is leveraging a legitimate blogging platform to host malicious content, a tactic that benefits from the inherent trust in Google‑hosted URLs. The lack of custom name‑server records and the use of a standard Blogspot IP make traditional DNS‑based mitigation less effective, emphasizing the need for URL filtering at the network perimeter. Because the exact page content, SSL certificate details, and HTTP response codes have not been disclosed, the full scope of the phishing campaign cannot be confirmed. However, the convergence of multiple blocklist entries, vendor detections on VirusTotal, and the active status of the domain provide sufficient actionable intelligence.

Defenders should prioritize adding facebook-q.blogspot.com to deny‑list rules across proxy, firewall, and endpoint protection solutions. Continuous monitoring of the IP address 142.251.20.132 for additional malicious sub‑domains is advisable, as attackers often reuse the same hosting asset. If possible, employ real‑time URL reputation services that incorporate the three known blocklists to automatically block user access.