facebook-psm[.]blogspot[.]nl

Analysis of the domain facebook-psm.blogspot.nl indicates active brand impersonation targeting Facebook users. As of July 12, 2026, the domain remains operational, returning an HTTP 302 redirect status, which is commonly used to obscure final landing pages in phishing campaigns. The domain resolves to IP address 142.250.185.97, part of AS15169 (Google LLC), and is hosted on infrastructure registered through Google. The SSL certificate is issued by Google Trust Services, a legitimate provider, which may reduce user suspicion during initial access. The page title is explicitly set to 'Facebook,' aligning with the observed scam type of social media phishing. No additional content analysis has been conducted, so specific phishing mechanics—such as credential harvesting forms or session token theft—remain unconfirmed. The domain is flagged by two security blocklists, including PhishDestroy and PhishingDB, and is detected by 14 of 95 security vendors on VirusTotal, indicating moderate consensus on its malicious nature. Infrastructure analysis reveals the use of Blogger as the hosting platform, alongside backend technologies including Java, Python, and OpenGSE. The presence of HTTP/3 suggests modern web protocols are employed, potentially to evade legacy detection methods. Defenders should prioritize blocking or monitoring access to this domain, particularly in environments where Facebook credentials are sensitive. Given the domain's persistence and active status, further investigation into redirect chains and associated infrastructure is recommended to identify downstream threats.