blockaml[.]net

This domain was registered through Tucows Domains Inc. on 21 February 2026 and immediately pointed to the Cloudflare‑owned address 104.21.48.1, which belongs to AS13335 in the United States. The DNS configuration lists bingo.ns.cloudflare.com and uriah.ns.cloudflare.com as authoritative name servers, confirming Cloudflare as the hosting provider. The site served a 521 “Web server is down” page with the title “blockaml.net | 521: Web server is down”, indicating that the payload has been taken offline. The TLS certificate presented is issued by Google Trust Services under the “WE1” profile, a legitimate certificate chain that does not by itself indicate malicious intent.

Network‑level analysis shows the use of HTTP/3, a feature commonly enabled on Cloudflare, but no additional application‑layer artifacts have been recovered. The only behavioural indicator available is a single detection by one of ninety‑three VirusTotal scanners, which flagged the domain as malicious, and the domain appears on a single external blocklist. PhishDestroy has also classified the domain as a crypto‑related scam, and the intelligence feed tags it as a “Crypto Scam”. No further evidence of phishing pages, credential harvesting, or malware distribution has been observed because the site is currently offline.

Uncertainty remains around the exact lure employed, the target audience, and whether the domain was ever used to host active phishing content before takedown. Defenders should continue to block 104.21.48.1 at the network perimeter, enforce DNS filtering for blockaml.net, and monitor any future re‑registration of the domain or related sub‑domains under the same Cloudflare account. Adding the domain to internal blocklists and sharing the indicator with threat‑intel platforms will help prevent inadvertent exposure if the infrastructure is resurrected.