facebook-psm[.]blogspot[.]gr

Analysis indicates that the domain facebook-psm.blogspot.gr is actively hosting a brand‑impersonation campaign targeting Facebook. The site returns an HTTP 302 redirect and presents a page title of “Facebook”. VirusTotal reports that 12 out of 95 scanned security vendors have flagged the domain as malicious, and the domain is currently listed on the PhishDestroy and PhishingDB blocklists. The SSL certificate is issued by Google Trust Services under the WE2 identifier, and the domain resolves to the IP address 172.253.63.132, which belongs to Google LLC (ASN 15169) and is geolocated in the United States.

Infrastructure analysis reveals that the domain is hosted on the Blogger platform, with additional server‑side components detected as Java, Python, and OpenGSE, and it supports HTTP/3. Registration was performed through Google, confirming the use of a legitimate registrar and a well‑known content‑hosting service. The combination of a legitimate hosting provider with a spoofed page title and brand target is a common pattern for social‑media phishing kits.

The observable evidence points to a high‑risk operation. The presence of the “Facebook” page title, the classification as a social_media scam, and the active blocklist entries demonstrate intent to deceive users into interacting with a counterfeit Facebook interface. However, the exact content of the landing page, credential‑capture mechanisms, or any payload delivery has not been publicly disclosed, leaving those vectors unverified.

Defenders should proactively block traffic to facebook-psm.blogspot.gr at the DNS or proxy level and add its resolving IP 172.253.63.132 to network‑level deny lists. Continuous monitoring of the IP and any associated subdomains is advised, as the attacker may rotate hosts within the same Google ASN. Incident response teams should treat any authentication attempts to Facebook originating from this domain as compromised and advise affected users to reset credentials.