blast-bag[.]fun

On July 23, 2026 analysts observed that blast-bag.fun was taken offline but left a forensic footprint that classifies it as a high‑risk crypto‑related impersonation campaign. The domain, created on March 22, 2026, was registered through PDR Ltd. d/b/a PublicDomainRegistry.com and points to the IP address 104.21.10.72, which belongs to Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare authoritative nameservers amit.ns.cloudflare.com and ingrid.ns.cloudflare.com, and the site served an SSL certificate issued by Let’s Encrypt (certificate identifier E8). Network‑level observations show the presence of HTTP/3, HSTS, and Cloudflare Browser Insights, indicating that the adversary leveraged Cloudflare’s edge services to mask origin infrastructure.

The page title returned by the server—"Airdrop Live | Claim Solana Token Airdrops"—directly references the Solana brand and aligns with the declared phishing kit type of an Airdrop Scam, confirming a targeted crypto‑airdrop lure. Independent security blocklists have listed the domain on PhishDestroy, MetaMask, ScamSniffer, and SEAL, and VirusTotal recorded 17 detections out of 94 scanners, reinforcing its malicious classification. A Gridinsoft trust score of 0 / 100 further reflects the absence of any legitimate reputation.

While the site is currently offline, defenders should assume the infrastructure was deliberately abandoned after a short campaign window. Recommendations include adding the domain and its resolved IP (104.21.10.72) to internal blocklists, monitoring for any re‑registration or similar sub‑domains using the same registrar or Cloudflare nameservers, and updating web‑filter and endpoint protection signatures to capture the observed page title pattern and SSL fingerprint. Continuous surveillance of the registrar PublicDomainRegistry.com for new registrations targeting Solana or other blockchain brands is advised, as the threat actor may reuse the same registration channel for future campaigns.