block-fi-login[.]blogspot[.]com

Analysis indicates that block-fi-login.blogspot.com is currently active and classified as a high‑risk credential‑phishing site. The domain is hosted on Google’s Blogger platform (registration through Google LLC) and resolves to the IP address 142.250.154.132. No nameserver records were returned, which is common for Blogger‑hosted subdomains. The domain appears on two public blocklists and has been flagged by PhishDestroy and OpenPhish. VirusTotal reports that 19 of 95 scanning engines have identified malicious behavior associated with the domain. The limited intelligence does not reveal the exact phishing landing page or targeted brand, and the page content has not been publicly analyzed. Defenders should treat any traffic to block-fi-login.blogspot.com as malicious, enforce URL filtering, and add the domain to local deny lists. Continuous monitoring of DNS queries for the IP 142.250.154.132 and correlation with credential‑theft incidents is recommended. Because the domain is hosted on a high‑reputation service, it may bypass simple reputation checks, so endpoint and email security solutions should inspect payloads and credential submissions for suspicious activity. Organizations should also share any observed indicators of compromise with threat‑sharing communities to improve collective detection.