facebook-blog-com[.]blogspot[.]fi

The domain facebook-blog-com.blogspot.fi is currently active and classified as a high‑risk brand‑impersonation campaign targeting Facebook. The site presents a page title of "Facebook", indicating a direct attempt to lure users of the social‑media platform. The threat is identified as a social_media scam and is listed as a confirmed phishing site in the intelligence feed.

Infrastructure analysis shows the domain resolves to the IPv6 address 2a00:1450:4001:80f::2001, which is allocated to AS15169, a Google‑owned network located in Germany. The site serves over HTTP/3 and presents an SSL certificate issued by a recognized certificate authority, confirming encrypted communications. Detected technologies include Blogger hosting, Java, Python, and OpenGSE, suggesting a mixed‑language backend possibly used for dynamic content generation.

Detection data indicates that 11 of 95 security vendors have flagged the domain as malicious, and the domain appears on a single security blocklist. The site returns an HTTP 302 redirect, a common tactic to conceal final destinations. Although the page title and technical fingerprints are known, the exact content served to victims remains unverified, leaving uncertainty around the specific credential‑capture mechanisms employed.

Defenders should prioritize immediate blocking of the domain at network perimeter controls and update intrusion‑detection signatures to include the observed IPv6 address and SSL fingerprint. Continuous monitoring for outbound connections to the identified IP range is advised, as is the inclusion of the domain in threat‑intel feeds. Given the high risk rating and active status, organizations should alert end‑users about the impersonation attempt and enforce multi‑factor authentication for Facebook accounts to mitigate potential compromise.