facebook-rus[.]blogspot[.]com

The domain facebook-rus.blogspot.com is currently flagged as a high‑risk generic phishing site. According to registration data, the domain is hosted under the Google LLC registrar, which is typical for Blogspot subdomains. DNS lookup returns a single A record pointing to 142.251.127.132, an IP address owned by Google’s public‑facing infrastructure. No authoritative nameserver records are returned (NS_NOT_FOUND), suggesting that the subdomain relies on the default Blogspot name service. The domain appears on one external security blocklist and is actively blocked by the PhishDestroy sink‑hole, confirming that threat‑intelligence feeds are already treating it as malicious.

VirusTotal analysis shows that seven out of ninety‑one scanned scanners label the domain as malicious, indicating a non‑trivial detection rate across independent engines. Publicly available telemetry does not include a page title, SSL certificate fingerprint, or HTTP response details, so the exact content served by the site cannot be verified at this time. The lack of explicit page metadata prevents confirmation of the phishing payload or any victim‑targeted branding, but the classification as “generic phishing” is supplied in the intelligence feed. The combination of an active blocklist entry, partial detection by multiple antivirus vendors, and the fact that the subdomain continues to resolve to a Google‑owned IP despite being blocked suggests an ongoing campaign that may be leveraging legitimate hosting to evade simple URL‑based filters.

Defenders are advised to enforce network‑level deny rules for the full hostname, include the domain in URL filtering policies, and monitor DNS queries for the associated IP address. Since the domain is hosted on a popular content‑hosting provider, additional scrutiny of outbound traffic to Blogspot hosts may be warranted. Continuous re‑scanning through multi‑engine services is recommended to capture any changes in the payload or additional detections.