app[.]blueoakfirm[.]com

Analysis performed on 24 July 2026 identifies the domain app.blueoakfirm.com as a brand‑impersonation infrastructure that has been taken offline. The domain was registered on 27 May 2025 via OwnRegistrar, Inc. and resolves to the IPv4 address 192.3.190.186, which belongs to AS36352 hosted by HostPapa in the United States. No TLS certificate is presented, indicating that the site operated over plain HTTP only. The page title returned from the host was "Blueoakfirm", matching the domain name and suggesting an attempt to mimic the legitimate Blueoak Firm brand.

Gridinsoft assigned a trust score of 0 out of 100, and the domain appears on a single security blocklist. It is also listed as blocked by the PhishDestroy service. The authoritative name servers are dns1.webproserver.com and dns2.webproserver.com, with a placeholder "null" entry observed. VirusTotal scanned the domain with 95 vendor engines but reported no detections; the absence of detections does not constitute a safety assurance.

The limited evidence set does not reveal the presence of a login portal, credential‑harvesting forms, or other payloads, and the site is currently offline, preventing direct observation of its content. However, the convergence of a low trust score, blocklist inclusion, and the brand‑impersonation classification warrants classification as a malicious phishing infrastructure. Defenders should continue to monitor DNS queries for the domain and its associated IP address, enforce blocklisting in perimeter defenses, and consider the domain as an indicator of compromise in threat‑intel feeds. Additional analysis of related subdomains or future re‑hosting attempts should be prioritized to confirm any ongoing campaign activity.