facebook-help-srilanka[.]blogspot[.]com

The domain facebook-help-srilanka.blogspot.com is presently active and resolves to the IP address 142.250.154.132, which belongs to Google’s public cloud infrastructure. Registration data shows the domain was acquired through Google LLC, a typical registrar for Blogger‑hosted subdomains. Google Safe Browsing has flagged the site for social engineering, indicating that the URL is being used to lure users into disclosing credentials or personal information. VirusTotal analysis reports that nine out of ninety‑five scanning engines have identified the domain as malicious, reinforcing the suspicion raised by Safe Browsing. The domain appears on a single external security blocklist and is also listed by PhishDestroy, confirming that at least one independent threat‑intel source has taken protective action against it. Technical checks reveal that the nameserver information is unavailable (NS_NOT_FOUND), which limits the ability to perform deeper DNS‑based reputation checks. No public information about SSL/TLS configuration, HTTP response codes, page title, or specific phishing kit has been disclosed, leaving those aspects of the threat surface undetermined. Given the convergence of multiple independent detections—Safe Browsing, VirusTotal, blocklist inclusion, and PhishDestroy blocking—defenders should treat the domain as high‑risk. Recommended mitigation steps include adding the domain to outbound filtering blocklists, monitoring DNS queries for any resolution attempts, and employing web‑gateway controls to prevent users from accessing the URL. Continuous re‑evaluation is advised, as the lack of detailed page content prevents a full attribution of the exact phishing vector, but the existing evidence is sufficient to warrant proactive defensive measures.