kulnde-dkev[.]blogspot[.]md

Analysis of the domain kulnde-dkev.blogspot.md shows it is currently active and returns an HTTP 302 redirect. The host resolves to IP 85.128.172.63, which is registered to AS15967 (Nazwa.pl Sp.z.o.o.) in Poland. The IP is advertised as part of Google’s network (ASN 15169) and the TLS certificate is issued by Google Trust Services / WE2, indicating use of Google’s certificate authority infrastructure. Web‑server headers reveal Apache HTTP Server with client‑side libraries including jQuery, Google Hosted Libraries, Google Analytics and Clipboard.js. No page title was observed, and the site does not expose additional content in the available snapshot. The domain appears on two independent blocklists (PhishDestroy and PhishingDB) and has a Gridinsoft trust score of 0 out of 100, reflecting a high confidence of malicious intent. VirusTotal reports 14 detections out of 95 scanned engines, corroborating the suspicion. The listed scam type is brand impersonation targeting the WordPress brand, and the brand target field explicitly names "wordpress". No further technical artifacts such as payloads, phishing forms, or credential‑harvesting scripts have been identified in the limited data set. Defenders should treat kulnde-dkev.blogspot.md as a high‑risk indicator. Immediate actions include adding the domain and its resolving IP to blocklists, denying outbound connections to the IP, and updating intrusion‑detection signatures to flag HTTP 302 responses from this host. Continuous monitoring of DNS queries for the domain and traffic to the associated IP is advised, as well as periodic re‑scanning for new malicious components. Because the site’s content has not been publicly captured, further analysis is required to confirm the exact phishing vector and to identify any downstream infrastructure.