betblast[.]fun

Analysis of the domain betblast.fun indicates active brand impersonation targeting the Blast platform, with high-risk indicators confirmed by multiple security sources. The domain was registered on November 18, 2025, through Gandi SAS and currently resolves to the IP address 188.114.97.3. Security vendors on VirusTotal flag this domain, with 5 out of 95 detecting malicious activity, while two independent blocklists have listed it as a threat. Additionally, the domain appears in 23 threat intelligence pulses on AlienVault OTX, reinforcing its association with known malicious campaigns. Infrastructure analysis reveals the use of Cloudflare services and HTTP/3 protocol, which may be leveraged to obfuscate traffic or evade detection. The SSL certificate is issued by Google Trust Services, a common practice among both legitimate and malicious domains to establish encrypted connections. While the exact content of the site remains unanalyzed, the domain is explicitly categorized as brand impersonation, aligning with the targeted brand identified in the intelligence data. Defenders should prioritize blocking this domain at the network level, particularly given its presence on multiple security blocklists and its association with confirmed phishing activity. The domain remains active as of July 12, 2026, and its registration age of less than eight months suggests it may still be in use for ongoing campaigns. Organizations should monitor for connections to the resolving IP address 188.114.97.3 and review logs for any interactions with betblast.fun, as these could indicate compromise or attempted credential theft. Further investigation into related infrastructure, such as domains registered through the same registrar or resolving to the same IP, may uncover additional threats.