bloger[.]028426[.]com

PhishDestroy identifies bloger.028426.com as a credential theft campaign with active infrastructure.

This domain is currently categorized as a credential theft resource due to its observed behavior targeting user authentication data. The campaign remains under investigation while security vendors refine detection signatures. At present, no detections have been recorded by VirusTotal vendors (14/95), though the domain is blocked by three blocklists, including OpenPhish and PhishingArmy, indicating confirmed malicious activity recognized by specialized threat intelligence providers.

Registered through MarkMonitor, Inc. on January 12, 2017, bloger.028426.com resolves to IP address 34.194.247.17 and benefits from a Let's Encrypt SSL certificate, enhancing its legitimacy to potential victims. Despite its age, the domain continues to be weaponized, with three active blocklist inclusions and zero VirusTotal detections as of the latest scan. Given the absence of AV signatures and the domain's infrastructure maturity, the risk of successful phishing or credential harvesting remains high. Users are strongly advised to block 34.194.247.17 at the network perimeter, avoid accessing the domain, and report indicators to local security teams or threat intelligence platforms. Monitor for lateral movement if credentials were previously entered.