blless[.]zone

blless.zone is an active domain that resolves to the IPv4 address 188.114.97.3. The address belongs to the autonomous system AS13335, a large content‑delivery network operating in the United States. The domain is delegated to the nameservers jay.ns.cloudflare.com and heidi.ns.cloudflare.com, indicating that the DNS resolution is managed through a widely used DNS service. HTTP requests to the site return a 403 Forbidden status, and the TLS handshake presents a certificate issued by a major public trust authority, with a validity chain anchored in a well‑known root. The page title returned by the server is the Hebrew phrase “רק רגע…”, which translates to “Just a moment…”, suggesting the presence of a placeholder or interstitial page rather than a functional landing page. Threat intelligence platforms have flagged the domain on a single security blocklist and it is listed as blocked by a dedicated phishing mitigation service. VirusTotal scans show that 2 of 95 scanned security vendors label the domain as malicious, reinforcing the suspicion of abuse. Automated fingerprinting detects the use of a CDN‑provided browser insights service, HTTP/3 protocol support, and other infrastructure typical of fast‑response hosting environments. While the available data confirms the domain’s active resolution, its restrictive HTTP response, and modest detection scores, the exact phishing campaign payload and targeted brand remain undefined because the site content has not been publicly harvested. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated IP and nameservers, and consider sharing the indicator with threat‑sharing communities to improve visibility. Ongoing observation of any changes in the HTTP response code or content could provide further insight into the threat’s evolution.