ruxbl-2new[.]blogspot[.]com

The domain ruxbl-2new.blogspot.com was registered on 21 February 2026 through MarkMonitor, Inc. and points to the IPv6 address 2a00:1450:4001:808::2001, which belongs to Google LLC (AS15169) and resolves to a location in Germany. The site is hosted on the Blogger platform, as indicated by the nameserver blogspot.l.googleusercontent.com and the detection of Blogger‑related technologies. Additional observed components include Java, Python, OpenGSE, and support for HTTP/3, suggesting a standard Blogger environment rather than a bespoke malicious kit. The SSL certificate presented is issued by Google Trust Services under the WE2 profile, consistent with legitimate Google‑hosted sites. When accessed, the server returned HTTP 404 and the page title “Blogia ei löydy”, Finnish for “Blog not found”.

This response indicates that the content has been removed or the domain is currently inactive. Nevertheless, the domain appears on a single security blocklist, PhishDestroy, and 16 of 95 VirusTotal scanners flagged it, reflecting some level of suspicion despite the offline status. Current intelligence gaps include the exact phishing payload or lure, the targeted brand or service, and any malicious redirects that may have been present before takedown. Analysts have not observed any credential‑harvesting forms or malicious scripts, and the page content has not been captured. Consequently, it is unclear whether the domain was used for a targeted credential‑stealing campaign or as a placeholder for future malicious activity.

Defenders should continue to block the domain at perimeter defenses and monitor for any resurgence of activity. Given the Google‑hosted infrastructure, standard URL filtering and DNS sinkholing can be applied without risking disruption of legitimate Blogger services. Threat‑intel feeds should be updated to retain the blocklist entry, and any future resolutions to the same IPv6 address should be scrutinized.