facebook-psm[.]blogspot[.]se

This domain is flagged for elevated risk due to brand impersonation targeting Facebook, specifically designed to mimic the legitimate Facebook login interface. The threat type involves credential harvesting, where unsuspecting users are tricked into entering their account credentials on a fraudulent page, leading to unauthorized account access and potential data exfiltration. Analysis indicates the domain facebook-psm.blogspot.se is hosted on infrastructure belonging to Google LLC (AS15169), resolving to the IP address 142.250.186.33. The page title explicitly matches the targeted brand, displaying 'Facebook' to enhance deception. VirusTotal detection metrics show 12 out of 95 security vendors flagging this domain as malicious. The domain appears on one security blocklist and is currently offline. The SSL certificate is issued by Google Trust Services (WE2), a common tactic to lend false legitimacy to phishing sites. Registration details confirm the domain is managed through Google's infrastructure, which aligns with the observed hosting patterns. Mitigation steps for this threat type include immediate blocking of the domain and its associated IP address (142.250.186.33) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing or interacting with the domain. End-users should be educated on recognizing brand impersonation tactics, such as verifying the URL structure and checking for SSL certificate discrepancies. Multi-factor authentication (MFA) should be enforced for all accounts to mitigate the impact of credential theft. Incident response teams should monitor for signs of compromised accounts linked to this domain and reset credentials for any affected users.