kulnde-dkev[.]blogspot[.]sg

The domain kulnde-dkev.blogspot.sg is currently listed on two public phishing blocklists and has been flagged by fifteen out of ninety‑five security vendors on VirusTotal. Its risk rating is high and the domain remains active as of the report date. The classification supplied by intelligence sources identifies the site as an impersonation of the WordPress platform, suggesting that attackers may be attempting to lure users seeking WordPress services.

Infrastructure analysis shows the domain resolves to the IPv4 address 85.128.172.63, which is hosted in Poland under AS15967 belonging to Nazwa.pl Sp.z.o.o. The hosting ASN is 15169, indicating registration through a major cloud provider. The TLS certificate presented by the server is issued by Google Trust Services and carries the WE2 descriptor, confirming the use of a standard publicly trusted certificate chain.

The web server identifies itself as Apache HTTP Server. Client‑side inspection reveals the use of the jQuery library, Clipboard.js, and additional third‑party scripts delivered via a public content delivery network. HTTP requests receive a 302 redirect response, and no page title is disclosed in the retrieved metadata. The observed technology stack aligns with typical WordPress‑related sites, reinforcing the impersonation claim.

Defenders should treat the domain as malicious despite the lack of visible page content. Immediate mitigation steps include adding the domain to network‑level block lists, configuring DNS filtering to prevent resolution, and monitoring outbound connections to the associated IP address. Continued reconnaissance is advised to capture any future changes in page content or credential‑collection behavior, which would further substantiate the threat vector.