gift-blosk[.]io

gift-blosk.io was registered on July 12, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare nameservers lady.ns.cloudflare.com and lou.ns.cloudflare.com. DNS resolution points to the IPv4 address 188.114.97.3. The domain appears on a single security blocklist and is actively listed by PhishDestroy, indicating that it is currently being used for malicious purposes. VirusTotal analysis shows that 2 of 91 submitted security vendors have flagged the domain, providing limited but non‑trivial detection coverage.

No additional reputation services such as Google Safe Browsing or OTX entries were supplied in the intelligence set, and no page title or SSL certificate details have been disclosed. The short registration window—only eleven days before the report date—combined with immediate blocklist inclusion suggests a purpose‑built phishing campaign rather than a long‑standing compromised site. Because the domain resolves to a Cloudflare‑managed IP, attribution to a specific operator is obscured, but the use of Cloudflare’s infrastructure is consistent with numerous phishing operations that leverage its CDN and DNS services for anonymity and resilience.

Defenders should continue to block traffic to 188.114.97.3 at network perimeter devices, enforce URL filtering rules that include the domain, and monitor DNS logs for queries to the associated Cloudflare nameservers. Threat‑intel feeds should be updated to reflect the domain’s high‑risk status, and any detection signatures that reference the two vendor flags should be reviewed for false‑positive potential. Ongoing observation is required to determine whether additional detection engines will flag the domain or whether the site will evolve its payload, as current evidence is limited to the initial registration and blocklist entries.