babulikinet[.]com

Analysis of babulikinet.com indicates that the domain is actively being used for a high‑risk phishing campaign. The domain resolves to the Cloudflare‑hosted address 104.21.93.240, with the IP geolocated to Canada and the infrastructure protected by Cloudflare, Inc. Registrant information shows the domain was registered through CNOBIN INFORMATION TECHNOLOGY LIMITED, and the authoritative nameservers are rodrigo.ns.cloudflare.com and sima.ns.cloudflare.com. The site presents a valid TLS certificate issued by Let’s Encrypt (identifier YE2) and returns an HTTP 301 redirect, suggesting a deliberate attempt to mask the final landing page. Threat intelligence sources corroborate malicious use: the domain appears on one public blocklist, is listed in five AlienVault OTX pulses, and has been flagged by 24 of 91 security vendors on VirusTotal. Additionally, PhishDestroy has added the domain to its blocklist. While the exact content of the hosted page has not been publicly disclosed, the combination of active hosting, valid SSL, and multiple detections confirms the domain’s role in phishing. Defenders should block DNS resolution to 104.21.93.240, add babulikinet.com to URL filtering policies, and monitor for any traffic patterns that reference the domain or its Cloudflare nameservers. Ongoing surveillance is recommended to detect any changes in hosting or certificate status.