blockdaglive[.]app

This domain, blockdaglive.app, was registered on 26 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the IP address 172.67.200.84, an address owned by a CDN provider located in Canada. The site returns an HTTP 403 status and presents a TLS certificate issued by a publicly trusted certificate authority. The only page title observed is “Just a moment…”, indicating a possible interstitial or challenge page; the full page content has not been publicly analyzed. Threat‑intelligence feeds have cited the domain in 22 separate pulses, and multiple security‑vendor scans have flagged it as malicious. Independent blocklists have already listed the domain, and its trust score is 0 out of 100, reflecting a high confidence of abuse. The domain uses default nameservers associated with the CDN provider, a pattern often seen in fast‑flux or abuse‑hosting configurations. Although the specific phishing payload or target is not disclosed, the recent creation date, low trust score, multiple vendor detections, and inclusion on blocklists collectively classify the domain as high‑risk. Defenders should block DNS resolution for blockdaglive.app, monitor outbound connections to 172.67.200.84, and incorporate the domain into URL filtering policies. Further investigation of the HTTP response body and any redirects is recommended to determine the exact credential‑harvesting technique employed.