facebook-psm[.]blogspot[.]no

Analysis of facebook-psm.blogspot.no indicates active brand impersonation targeting Facebook users, classified as a high-risk social media phishing domain. The domain was registered on July 16, 2025, through Google's Blogger platform (AS15169, Google LLC) and remains operational as of July 22, 2026. Infrastructure analysis reveals hosting on Google's infrastructure, resolving to IP 142.250.186.129 (US), with an HTTP 302 redirect status, suggesting dynamic content handling or intermediate redirection. The SSL certificate is issued by Google Trust Services (WE2), a common feature of legitimate and malicious domains alike, providing no inherent trust signal.

Detection data shows the domain is flagged by 16 of 95 security vendors on VirusTotal and appears on at least one security blocklist (PhishDestroy). The page title is explicitly 'Facebook,' aligning with the observed brand impersonation. Technologies detected include Blogger, Java, Python, and OpenGSE, consistent with Google's hosting environment but offering no definitive malicious indicators on their own. The scam type is confirmed as social media phishing, though the exact mechanics (e.g., credential harvesting, malware distribution) are not yet analyzed due to limited visibility into page content.

Defenders should prioritize blocking this domain at DNS, proxy, or endpoint levels, particularly in environments where Facebook access is restricted or monitored. The use of a Blogger subdomain (blogspot.no) may complicate takedown efforts, as Google's abuse processes for such domains can be slower than for standalone registrations. No evidence links this domain to broader phishing campaigns, but the combination of brand impersonation, active status, and vendor detections warrants immediate action. Further investigation into redirect chains or associated infrastructure may reveal additional malicious domains or hosting patterns.