kastkast[.]blogspot[.]com

Analysis of kastkast.blogspot.com indicates that the site is being used for a high‑risk crypto‑drainer phishing campaign. The domain is hosted on Google Blogger and resolves to the IPv6 address 2606:4700:20::ac43:4634, which is assigned to AS15169 (Google LLC) located in Germany. HTTP requests receive a 301 redirect and the site presents a TLS certificate issued by Google Trust Services under the WE2 label, confirming the use of Google’s certificate infrastructure. Detected web technologies include Envoy, reCAPTCHA, HSTS, Google Analytics, Cloudflare Browser Insights and Cloudflare, suggesting a mixed CDN and security stack. The page title returned by the server is “KAST: The #1 Stablecoin App”, matching the reported scam type of a crypto drainer. The domain appears on three public security blocklists and is specifically blocked by PhishDestroy, MetaMask and SEAL. VirusTotal analysis shows that one of ninety‑one scanners flagged the domain, and the Gridinsoft trust score is 0/100, reinforcing the malicious assessment. The infrastructure details are limited to the hosting provider and the IPv6 address; no additional command‑and‑control endpoints or payloads have been observed. Defenders should immediately add kastkast.blogspot.com to URL filtering and DNS block lists, monitor outbound connections to the identified IPv6 address, and educate users about unsolicited requests to interact with “KAST” applications that request cryptocurrency credentials. Ongoing surveillance is advised to detect any changes in hosting or content, and any observed phishing emails should be reported to the relevant incident response teams.