121bax[.]brellia[.]cc

Analysis of 121bax.brellia.cc shows that the domain was registered on 25 February 2026 through NiceNIC International Group Co., Limited. The authoritative nameservers are a.dnspod.com and c.dnspod.com, and the domain resolves to IP address 217.60.62.75, which belongs to ASN AS56971 operated by a cloud provider in Finland. No TLS certificate is presented, indicating that HTTPS is not available. The only visible HTTP artifact is the page title “Staking”, which suggests a possible focus on financial or cryptocurrency‑related lure, though the content has not been captured.

VirusTotal reports that 15 of 93 scanning engines flag the domain as malicious, and the domain appears on a single external blocklist, where it is listed by PhishDestroy. The current host has taken the site offline, and further live probing is not possible. The evidence points to a phishing‑type infrastructure that was actively hosted as recently as early 2026. The combination of a recent registration date, cloud‑based hosting, lack of encryption, and multiple vendor detections aligns with typical patterns of short‑lived phishing campaigns.

However, the absence of a TLS certificate, the limited public blocklist presence, and the single observed page title leave the exact victim‑targeting vector undefined. Defenders should continue to block the domain at perimeter filters, update DNS‑sinkhole entries, and monitor for any resurgence of the IP address or related sub‑domains. Additional telemetry such as HTTP request logs, TLS handshake attempts, or user‑reported clicks should be correlated to confirm exploitation attempts. Because the site is currently offline, ongoing surveillance is recommended to detect re‑hosting or repurposing of the same infrastructure.