info-resmi849[.]blogspot[.]com

This domain, info-resmi849.blogspot.com, is identified as a credential theft phishing infrastructure targeting users through deceptive login prompts or fake authentication portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, but the domain exhibits characteristics typical of credential harvesting campaigns, including the use of a free subdomain service (blogspot.com) to evade detection and reduce operational costs. The page title 'Blog introuvable' suggests either a placeholder or a deliberate attempt to mislead users into believing the site is non-functional, potentially redirecting them to a secondary malicious endpoint not immediately visible in initial scans. Infrastructure analysis reveals the following technical indicators: the domain is flagged by 17 out of 95 security vendors on VirusTotal, indicating a moderate to high confidence level in its malicious classification. It was registered through MarkMonitor, Inc., a registrar commonly used for both legitimate and malicious domains, and resolves to the IP address 142.251.141.65, hosted on Google LLC's AS15169 infrastructure. The domain was created on February 21, 2026, though this date may reflect a typo or placeholder, as it predates the current year. The SSL certificate is issued by Google Trust Services (WE2), providing a false sense of security to users. The domain appears on one security blocklist and is currently offline, though its prior activity and infrastructure remain a concern. The current status of info-resmi849.blogspot.com is offline, likely due to takedown actions or abandonment by the threat actor. However, the residual risk persists due to the domain's prior use in credential theft operations and the potential for reactivation or migration to a new subdomain or hosting provider. Users who may have interacted with this domain are advised to reset credentials for any accounts accessed during the exposure window, enable multi-factor authentication where possible, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP address to prevent future access attempts. The use of Google's infrastructure underscores the challenge of distinguishing malicious activity within widely trusted hosting environments.