blankfinvex-ai[.]net

blankfinvex-ai.net was observed on 12 July 2026 as an active generic phishing domain. The domain was registered on 26 February 2026 through Sav.com, LLC and resolves to the IP address 172.67.157.28, which belongs to AS13335 Cloudflare, Inc. in the United States. The authoritative nameservers are andronicus.ns.cloudflare.com and carla.ns.cloudflare.com. An HTTP request returns status code 200 and the page title is identical to the domain name. No TLS certificate is presented, indicating the site is served over plain HTTP.

The domain is listed on three security blocklists and has been blocked by multiple mitigation services. Public scanning service analysis shows that one out of ninety‑five security vendors flagged the domain, providing an early indication of malicious intent. The trust score is 0 out of 100, reinforcing the low credibility of the site.

Despite the available infrastructure data, the specific content and phishing vector employed by blankfinvex‑ai.net remain unverified, as no detailed page capture is provided. The absence of an SSL certificate limits the ability to assess certificate‑based indicators, and the low detection count suggests limited exposure or recent deployment. Consequently, the full scope of the campaign, including targeted entities or credential‑harvesting mechanisms, cannot be confirmed at this time.

Defenders should treat blankfinvex‑ai.net as a high‑risk indicator and enforce network‑level blocking of the domain and its resolved IP address. Continuous monitoring of the associated Cloudflare IP range is advised, as the infrastructure may be reused for additional malicious domains. Updating intrusion‑prevention signatures to include the observed nameserver pattern and registering the domain on internal blocklists will reduce the likelihood of successful exploitation.