facebook-psm[.]blogspot[.]fi

Analysis indicates that facebook-psm.blogspot.fi is an active credential-theft phishing site impersonating Facebook. The domain resolves to 142.250.185.97, hosted on Google LLC infrastructure (AS15169), and is registered through Google's Blogger platform. The page title explicitly displays 'Facebook,' aligning with the confirmed brand target. A 302 HTTP redirect suggests dynamic routing, potentially used to evade detection or obscure final landing pages. The domain is flagged by 13 of 95 security vendors, with a Scamadviser trust score of 1/100, further corroborating its malicious classification. Infrastructure analysis reveals the use of Google Trust Services SSL certificates (WE2) and technologies including Blogger, Java, Python, and OpenGSE, which are consistent with legitimate hosting environments but exploited here for phishing purposes. The domain appears on two security blocklists and is actively blocked by at least two threat intelligence feeds. While the exact phishing kit or payload remains unanalyzed, the combination of brand impersonation, low trust scores, and detection by multiple vendors confirms its role in social media credential harvesting. Defenders should prioritize blocking this domain at the DNS and network level, particularly in environments where Facebook access is common. Monitoring for related subdomains or IP-based indicators (142.250.185.97) may help identify additional malicious activity. Given the domain's continued activity as of July 12, 2026, immediate action is recommended to mitigate user exposure.