# PhishDestroy domain threat record: mm2item.blogspot.com Content language: English Canonical HTML report: https://phishdestroy.io/domain/mm2item.blogspot.com/ Machine-readable companion: https://phishdestroy.io/domain/mm2item.blogspot.com/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-09-14 14:10:22 UTC - Last availability or vendor check: 2026-10-22 10:06:53 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 2/91 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: google ## Stored infrastructure - Observed IP address: 142.250.154.132 - Registrar in stored WHOIS data: Google Blogger - Registrar country in stored WHOIS data: US - Last stored HTTP status: 200 - Registration date (registry RDAP, blogspot.com): 2000-07-31 21:38:58 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0a043-012c-77ee-9db1-512ca9d3243a/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/mm2item.blogspot.com - Certificate Transparency search: https://crt.sh/?q=%25.mm2item.blogspot.com - Web Archive lookup: https://web.archive.org/web/*/https://mm2item.blogspot.com/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview mm2item.blogspot.com is a Blogger-hosted impersonation phishing page titled "MM2 Item Rewards." It trades on Murder Mystery 2, the Roblox game whose knives, guns and pets are traded and collected by a largely young player base. PhishDestroy first saw it on 2026-09-14, and it was still online with its content live on 2026-10-19. How the scam works Lures like this promise rare MM2 items for free, then put a step between the player and the reward. That step is typically a fake Roblox sign-in, a request to share account details, or instructions to paste code or run a "verification" that hands the session to the operator. Once the account is taken, its inventory, limiteds and any Robux can be traded away. The account itself is often hijacked to spread the same lure to friends. Evidence Detection is thin. On 2026-09-28 only 2 of 91 VirusTotal engines flagged the page, Forcepoint ThreatSeeker and VIPRE. PhishDestroy is the only blocklist carrying it. That gap is why the page is still reachable more than a month after we first saw it, and why most browsers and filters will not warn a visitor today. Infrastructure There is no domain registration behind this operation. It is a free subdomain on Google's Blogger platform, served from Google LLC infrastructure in the US. The HTTPS certificate comes from Google Trust Services (WE2), the platform's default for every blogspot page. The padlock and the familiar blogspot address therefore say nothing about who runs the site. This setup costs the operator nothing and is easy to replace when one page is taken down. What to do If you or your child entered a Roblox username and password here, change the password right away. Turn on 2-step verification and sign out of all other sessions from the account's security settings. If you pasted anything into the browser or ran a file the page offered, change the password again from a clean device and check for unexpected trades or friend messages. Report lost items through Roblox support. Defenders and parents should block the subdomain, report it to Blogger as phishing, and warn players that free MM2 item offers outside the game are a common account-theft lure. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0a043-012c-77ee-9db1-512ca9d3243a/ VirusTotal report: https://www.virustotal.com/gui/domain/mm2item.blogspot.com Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=mm2item.blogspot.com Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 09:42:52 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0a043-012c-77ee-9db1-512ca9d3243a.png Captured: 2026-09-14 14:10:22 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a0a043-012c-77ee-9db1-512ca9d3243a.png Captured: 2026-09-22 03:30:38 UTC Source report: https://urlscan.io/result/01a0a043-012c-77ee-9db1-512ca9d3243a/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/adce5b53-8b96-4e2a-b07d-e49036591023.png Captured: 2026-09-21 08:05:08 UTC Source report: https://radar.cloudflare.com/scan/adce5b53-8b96-4e2a-b07d-e49036591023 SHA-256: 8b6815e1921e8ae7dffde8262433e3d724b5ec655109bba17bcd4de4fda1a2d1 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T22:22:45Z", "uuid": "01a0a043-012c-77ee-9db1-512ca9d3243a", "scanned_at": "2026-09-14T14:12:27Z", "final_url": "https://mm2item.blogspot.com/", "status": 200, "redirected": "same-domain", "redirects": [ { "to": "https://mm2item.blogspot.com/", "from": "https://mm2item.blogspot.com/", "status": 302 } ], "ip": "2a00:1450:4001:c0f::84", "ips": [ "142.251.127.132", "2a00:1450:4001:c0f::84" ], "asns": [ "15169" ], "countries": [ "US", "DE" ], "link_domains": [ "www.blogger.com" ], "doc_hash": "fee5eeea5ae6a7de186c2ca3c68da2e2065514c719a103cc4bfa5c0a9b7ef486", "script_hashes": [ "068ffe90977f2b5b2dc2ef18572166e85281bd0ecb31c4902464b23db54d2568" ], "globals": [ "adsbygoogle", "continueOffer", "goCPA", "cookieChoices", "CPA_LINK" ], "tls": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "cipher": "AES_128_GCM", "issuer": "WE2", "subject": "misc-sni.blogspot.com", "protocol": "TLS 1.3", "valid_to": "2026-11-02T08:38:52Z", "valid_from": "2026-08-10T08:38:53Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 35, "tls_valid_days": 83, "requests": 3, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 92, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "GSE", "content-type": "text/html; charset=UTF-8", "x-content-type-options": "nosniff" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T22:30:56Z", "uuid": "adce5b53-8b96-4e2a-b07d-e49036591023", "scanned_at": "2026-09-21T08:05:08Z", "final_url": "https://mm2item.blogspot.com/", "status": 200, "history": [ { "url": "https://mm2item.blogspot.com/", "status": 200 } ], "dom_hash": "996f91aa3d63af0a5dc0e19f309a2f5e80291d20e45837d8f603296cb9743d4d", "doc_hash": "ff0c2246c3ed5fdadb76810b4ab5365bc81b1d9ccdffd93bbeb40d4685e54c4f", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "mm2item.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "name": "mm2item.blogspot.com", "type": "CNAME", "value": "blogspot.l.googleusercontent.com" } ], "dnssec_valid": false, "ip": "142.251.218.193", "whois": { "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T21:38:58Z", "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-22T01:53:56Z", "analysis_at": "2026-10-13T19:37:27Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 3, "suspicious": 0, "undetected": 34 }, "detections": { "VIPRE": "malware", "alphaMountain.ai": "phishing", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "tags": [ "dga" ], "categories": { "alphaMountain.ai": "Personal Sites/Blogs, Phishing (alphaMountain.ai)" }, "registrar": "MarkMonitor Inc.", "created": "2000-07-31T21:38:58Z", "expires": "2027-07-31T21:38:58Z", "updated": "2026-06-29T10:34:06Z", "first_seen": "2026-09-14T14:10:15Z", "dns": [ { "ttl": 300, "type": "AAAA", "value": "2607:f8b0:4001:c7b::84" }, { "ttl": 300, "type": "CNAME", "value": "blogspot.l.googleusercontent.com" }, { "ttl": 300, "type": "A", "value": "192.179.16.132" } ], "dns_at": "2026-10-13T19:37:58Z", "jarm": "27d40d40d29d40d1dc42d43d00041ded961c16c68658e95145597cf992c36c", "cert": { "san": [ "misc-sni.blogspot.com", "blogspot.ae", "*.blogspot.ae", "blogspot.al", "*.blogspot.al", "blogspot.am", "*.blogspot.am", "blogspot.ba", "*.blogspot.ba", "blogspot.be" ], "issuer": "Google Trust Services / WR2", "serial": "314459051a6865d30a64aaa66545849a", "sha256": "4857922e4732af9da27dfbbe57b2c741da8a8af83def47e9345092cbed8e2508", "subject": "misc-sni.blogspot.com", "valid_to": "2026-12-11T20:01:21Z", "valid_from": "2026-09-18T20:01:22Z" }, "whois": { "registrar": "MarkMonitor Inc.", "registrar_iana_id": "292", "registrar_url": "http://www.markmonitor.com", "created": "2000-07-31T07:00:00Z", "updated": "2026-06-29T10:34:06Z", "expires": "2027-07-31T00:00:00Z", "status": [ "clientDeleteProhibited", "clientTransferProhibited", "clientUpdateProhibited", "serverDeleteProhibited", "serverTransferProhibited", "serverUpdateProhibited" ], "nameservers": [ "ns1.google.com", "ns2.google.com", "ns3.google.com", "ns4.google.com" ], "dnssec": "unsigned" } } } ```