facebook-find[.]blogspot[.]com

The domain facebook-find.blogspot.com is currently active and classified as a high‑risk brand impersonation targeting Facebook. Infrastructure analysis shows the site resolves to the IP address 192.178.183.132, which is hosted by Google LLC in the United States. The HTTPS certificate is issued by Google Trust Services under the WE2 certificate authority, confirming the use of Google’s TLS infrastructure. DNS queries return a “NS_NOT_FOUND” status, indicating that authoritative name server information is not publicly disclosed. The web server responds with HTTP 200, and the page title is simply "facebook," matching the declared brand target. Technical fingerprints reveal the presence of Blogger as the content management platform, along with Java, Python, OpenGSE, Google AdSense, and HTTP/3 support, suggesting a standard Google‑hosted blog setup repurposed for malicious use.

Detection data shows that 15 out of 91 security vendors on VirusTotal flag the domain, and it appears on two external blocklists. Both PhishDestroy and Phishunt have listed the domain as malicious, reinforcing its reputation as a phishing vector. The site is registered through Google LLC, which aligns with the hosting and SSL details. No additional public intelligence, such as Safe Browsing or OTX entries, is presently available.

Uncertainty remains around the specific payload delivered to victims, as no page content analysis has been published. Defenders should block the domain at DNS and proxy layers, monitor outbound traffic for connections to 192.178.183.132, and update intrusion detection signatures to include the observed user‑agent and technology stack. Security teams are advised to add the domain to internal blocklists, advise users to avoid any unsolicited communications referencing Facebook that direct to a blogspot URL, and continue to monitor VirusTotal and other reputation services for any changes in detection scores.