kulnde-dkev[.]blogspot[.]rs

The domain kulnde-dkev.blogspot.rs is currently listed as an active brand‑impersonation site targeting WordPress. Its risk rating is high and it has been flagged by multiple security services. VirusTotal records show that 14 of 95 scanned vendors raise detections, and the domain appears on the PhishDestroy and PhishingDB blocklists. Infrastructure analysis reveals the domain was registered on March 10 2008 through the registrar Webglobe d.o.o. It resolves to the IPv4 address 85.128.172.63, which is announced by AS15967 belonging to Nazwa.pl Sp.z.o.o. in Poland. The host uses Google‑provided name servers (ns1‑ns4.google.com) and presents a Google Trust Services certificate issued to "WE2". HTTP requests receive a 302 redirect, and the underlying web stack includes Apache HTTP Server with jQuery, Google Hosted Libraries, Google Analytics, and Clipboard.js. Reputation signals are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and two independent blocklists already block the domain. No page title or site content has been extracted, so the exact landing page layout and any credential‑harvesting mechanisms remain unknown. The lack of a visible title means automated content analysis cannot confirm the visual impersonation tactics employed. Defenders should block the address 85.128.172.63 at network perimeters and add kulnde-dkev.blogspot.rs to DNS sinkhole lists. Email gateways should be configured to flag any messages containing this domain. Continuous monitoring of the associated IP range and the Google name‑server set is advised, as the operator may shift hosting while retaining the same domain. Incident response teams should treat any credential submissions to this domain as potentially compromised WordPress accounts and advise affected users to reset passwords and enable multi‑factor authentication.