app[.]bounceblt[.]net

This domain, app.bounceblt.net, is flagged as a generic phishing endpoint designed to deceive users into disclosing credentials or sensitive information. Analysis indicates no direct brand impersonation or crypto drainer kit association, though the infrastructure leverages Cloudflare to obfuscate malicious activity. The 404 Not Found page title suggests either a placeholder, a takedown response, or a cloaking mechanism to evade detection during inactive periods.

Technical indicators reveal the domain resolves to IP address 104.21.28.25, a Cloudflare node, and was registered on April 14, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal reports 4 out of 95 security vendors flagging the domain as malicious, while it appears on two security blocklists: PhishDestroy and OISD. No Google Safe Browsing (GSB) hits were recorded at the time of analysis. Detected technologies include Cloudflare Browser Insights, Cloudflare CDN, and HTTP/3, all of which are commonly abused to mask phishing infrastructure and evade traditional network-based defenses.

The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. However, residual risk persists as the infrastructure may be reactivated under a different domain or subdomain. Organizations are advised to block the domain and its resolving IP at the perimeter, monitor for related domains registered through the same registrar, and implement real-time URL filtering to prevent access to similar phishing endpoints. Users should verify the legitimacy of any unexpected communications or login prompts, particularly those leveraging Cloudflare-protected domains.