bloxtools[.]st

Bloxtools.st has been identified as a generic phishing domain, primarily used for fake login attempts. The domain does not appear to be impersonating a specific brand or utilizing a particular drainer kit. The page title 'Just a moment...' suggests that the phishing infrastructure may have been designed to mimic a loading or verification screen to trick users into providing sensitive information.

Technical analysis reveals that Bloxtools.st has been flagged by 15 out of 95 security vendors on VirusTotal, indicating a moderate level of suspicion. The domain is registered through ST Registry and resolves to the IP address 172.67.139.89, which is located in the United States and part of the AS13335 Cloudflare, Inc. network. The domain was created on February 23, 2025, and currently appears on 2 security blocklists, including PhishDestroy and PhishingDB. The SSL certificate for the domain is issued by Let's Encrypt, which is a common choice for phishing operators due to its ease of use and cost-effectiveness.

The current status of Bloxtools.st is offline, suggesting that it has been taken down or is not actively being used at this time. Despite this, the elevated risk level indicates that the domain may still pose a threat to unsuspecting users who stumble upon it. Response actions should include updating security blocklists and warning users to avoid the domain. The remaining risk is significant, as the domain could be reactivated or repurposed by threat actors in the future. Users are advised to remain vigilant and report any suspicious activity related to this domain.