blazpay[.]io

Analysis of the domain blazpay.io indicates it was operating as a phishing site targeting payment or financial services. The domain was registered on February 21, 2026, through Dynadot LLC and resolved to the IP address 54.215.31.113, hosted on Amazon.com, Inc. infrastructure (AS16509) in the United States. Nameservers ns1.dyna-ns.net and ns2.dyna-ns.net were configured for DNS resolution. The site employed a Let's Encrypt SSL certificate (E8) and utilized Cloudflare for content delivery and security, including HTTP/3 and HSTS protocols, alongside Node.js and Express for backend processing. The domain was flagged by 14 of 93 security vendors on VirusTotal, though the exact nature of the detected threat remains unspecified.

Two security blocklists, PhishDestroy and ScamSniffer, explicitly blocked access to blazpay.io. Gridinsoft assigned a trust score of 0 out of 100, further corroborating its malicious classification. The page title 'Just a moment...' suggests the use of Cloudflare protection or a holding page, though the underlying phishing content was not directly observable at the time of assessment. Infrastructure analysis reveals the domain was taken offline by July 23, 2026, limiting further forensic examination.

Defenders should treat blazpay.io as a confirmed phishing domain, particularly for campaigns impersonating payment portals. Network security teams are advised to update blocklists to include this domain and its associated IP address. Given the use of Cloudflare and Let's Encrypt, similar domains may emerge using comparable infrastructure, warranting monitoring for newly registered domains with matching nameserver or hosting patterns. The lack of explicit brand targeting in available data precludes attribution to a specific financial institution or service.