blessnetwork-checker[.]xyz

This investigation documents the infrastructure observed for blessnetwork-checker.xyz, which was classified as a generic phishing site and assigned an elevated risk rating. The domain was registered on February 21, 2026 and currently resolves to the IP address 104.21.96.1, which belongs to AS13335 operated by Cloudflare, Inc. in the United States. The site presented the page title “Bless Dashboard” and employed an SSL certificate identified as WE1, indicating the use of HTTPS despite the underlying malicious intent. Reputation checks show the domain appears on five independent security blocklists, specifically PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura, all of which have listed it as malicious.

A Gridinsoft trust score of 0 out of 100 further confirms its lack of legitimacy. VirusTotal analysis recorded detections from seven of ninety‑three scanning engines, reinforcing the malicious classification. The hosting provider’s infrastructure is shared, which may host other unrelated benign services, but the observed IP is presently taken offline, reducing immediate exposure.

Defenders should add blessnetwork-checker.xyz to URL filtering rules, block the associated IP 104.21.96.1 at the network perimeter, and monitor for any future re‑activation of the domain or related sub‑domains. Continuous watch of the listed blocklists and periodic re‑scans on VirusTotal are recommended to capture any changes in detection status. Given the low trust score, presence on multiple blocklists, and confirmed detections, the domain should be treated as hostile and excluded from trusted traffic.