facebook-psm[.]blogspot[.]is

Analysis indicates that the domain facebook-psm.blogspot.is is actively engaged in brand impersonation targeting Facebook, as confirmed by its page title and known intelligence. The domain is hosted on infrastructure belonging to Google LLC (AS15169) and resolves to the IP address 142.250.185.97, located in the United States. The site returns an HTTP 302 redirect status, suggesting it may be part of a larger redirection chain designed to evade detection or lead victims to credential-harvesting pages. The SSL certificate is issued by Google Trust Services, a common feature in both legitimate and malicious domains leveraging cloud hosting. Technologies detected on the domain include Blogger, Java, Python, and OpenGSE, which align with standard Blogger platform components but do not rule out malicious use. The domain appears on two security blocklists, PhishDestroy and PhishingDB, and is flagged by 13 of 95 security vendors in a recent scan. While the exact content of the page has not been analyzed, the page title explicitly displays 'Facebook,' reinforcing the brand impersonation classification. Defenders should treat this domain as high-risk infrastructure. Given its active status and association with social media phishing, network-level blocking or monitoring of the IP and domain is recommended. Further investigation into redirection endpoints and associated domains may uncover additional components of this campaign. No evidence suggests this domain is part of a broader malware distribution or exploit kit operation at this time.