bluecas[.]com

The domain bluecas.com was registered on 21 February 2026 through GMO Internet Group, Inc. d/b/a Onamae.com. It is currently listed as active and is categorized under the generic_phishing threat type with a risk level of under_investigation. Technical resolution shows bluecas.com pointing to IP address 15.197.240.20, which belongs to the Amazon.com, Inc. network (AS16509) located in the United States. The authoritative name servers are ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-domain.com, both indicating a verification‑hold status. The web server identified by banner analysis runs Nginx with the OpenResty module, and the TLS certificate is issued by GoDaddy.com, Inc. (Go Daddy Secure Certificate Authority – G2). An HTTP request returns a 404 status code, suggesting that the front‑end page is either removed or intentionally hidden. Reputation services assign a trust score of 0 out of 100, and the domain appears on a single security blocklist. PhishDestroy has already blocked the domain. VirusTotal currently reports zero detections, but the absence of detections does not confirm safety, and no public page content has been disclosed for further analysis. Given the observed infrastructure, defenders should proactively deny traffic to bluecas.com at network perimeters, add the domain and its associated IP address to threat intelligence feeds, and monitor for any DNS changes or new hosting vectors. Continued observation is advised to confirm whether the site becomes operational or is linked to broader phishing campaigns.