kdn33a[.]blogspot[.]com

The domain kdn33a.blogspot.com was registered on March 07, 2026 through MarkMonitor, Inc. and is hosted on Google’s infrastructure, resolving to IP address 172.217.168.65, which belongs to AS15169 Google LLC in the United States. The site presents a HTTP 200 response and serves content over TLS using a certificate issued by Google Trust Services under the WE2 label. Technical profiling shows the site runs on the Blogger platform and incorporates Java, Python, YouTube embeds, OpenGSE scripts, Google AdSense, and HTTP/3. The page title reported is “KDN33A”. The domain is currently listed on one security blocklist and has been blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. Threat intelligence classifies the site as a generic phishing campaign, though VirusTotal has not recorded any detections (0/95 scans). The lack of detections does not imply safety; the low trust score and inclusion on a blocklist suggest active exploitation. The campaign’s infrastructure is limited to a single Google‑hosted IP, which may be leveraged to obscure the attacker’s true location. Defenders should treat kdn33a.blogspot.com as a high‑risk indicator. Immediate actions include adding the domain to outbound filtering rules, monitoring DNS queries for the associated IP, and applying URL filtering to block HTTP requests to the site. Continuous re‑evaluation is advised, as additional detections may appear in future VirusTotal scans or blocklist updates. At present the campaign’s payload and credential‑harvesting mechanisms have not been publicly disclosed, leaving the exact phishing vector uncertain. Security teams should collect samples of the page content and any redirects for sandbox analysis, and share findings with community feeds to improve detection coverage.