login-wellsfargo[.]blogspot[.]com

The domain login-wellsfargo.blogspot.com is currently classified as high‑risk and active in a banking phishing campaign. Technical resolution shows the hostname maps to IP address 142.251.38.65, an address that belongs to a large public cloud provider and is frequently leveraged for malicious hosting. The domain is listed on three independent phishing blocklists—PhishDestroy, OpenPhish, and Phishunt—indicating that multiple anti‑phishing services have observed malicious activity originating from this host.

Google Safe Browsing has flagged the site for social engineering, confirming that the URL is recognized as a vector for credential harvesting. VirusTotal analysis reports that five out of ninety‑one scanned security vendors have generated detections for the domain, providing additional corroboration of its malicious nature. While the exact page content, SSL certificate details, HTTP response codes, and registrar information have not been disclosed, the available evidence is sufficient to deem the domain unsafe.

Defenders should immediately block login-wellsfargo.blogspot.com at the network perimeter and DNS filtering layers, incorporate the associated IP address into threat‑intel feeds, and monitor for any outbound connections to that address. Continuous re‑evaluation is advised, as further telemetry such as page title or additional vendor detections may emerge, but the current indicators already justify a proactive mitigation stance.