facebook-psm[.]blogspot[.]pe

The domain facebook-psm.blogspot.pe is currently active and classified as a high‑risk brand‑impersonation campaign targeting the Facebook brand. The site returns an HTTP 302 redirect and presents the page title “Facebook”. Network resolution points to the IP address 172.217.18.1, which resides in the United States and is owned by Google LLC (ASN 15169). The TLS certificate is issued by Google Trust Services under the WE2 subsidiary, confirming that the connection is encrypted with a legitimate Google‑issued certificate.

Passive infrastructure analysis shows that the domain is hosted on the Blogger platform and leverages a mixed technology stack that includes Java, Python, OpenGSE, and HTTP/3 support. The presence of these components suggests a custom back‑end built on top of the Blogger service rather than a simple static blog. Registration details indicate that the domain was provisioned through Google, reinforcing the use of legitimate hosting services to obscure malicious activity.

Threat intelligence feeds have recorded 13 of 95 scanned security vendors flagging the domain as malicious, and the domain appears on two public blocklists – PhishDestroy and PhishingDB. The combination of a brand‑impersonation page title, active redirect, and multi‑vendor detection elevates the confidence that this infrastructure is being used for credential‑stealing or social‑media fraud targeting Facebook users.

Defenders should add facebook-psm.blogspot.pe to URL filtering and DNS block lists, monitor outbound connections to the associated Google IP, and enforce multi‑factor authentication for Facebook accounts to mitigate credential compromise. Continuous re‑scanning of the domain and its hosting infrastructure is recommended, as the use of a reputable hosting provider may enable rapid re‑deployment of similar impersonation sites.