excitementashenblood[.]shop

The domain excitementashenblood.shop has been identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis confirms the domain is currently offline, though prior activity indicates an elevated risk profile. No specific brand impersonation has been conclusively linked to this domain, though the generic phishing infrastructure suggests broad targeting of authentication credentials. Infrastructure analysis reveals the domain was registered on June 12, 2026, through Namecheap, Inc. and resolves to the IP address 188.114.97.3. Security vendors on VirusTotal flagged the domain in 6 of 95 detections, while it appears on a single security blocklist. The domain holds a Gridinsoft trust score of 0 out of 100, reinforcing its malicious classification. Additional technical indicators include the use of a Let’s Encrypt SSL certificate and Cloudflare-hosted infrastructure, with HTTP/3 protocol support detected. The domain was previously documented in four AlienVault OTX threat intelligence pulses, further corroborating its association with phishing campaigns. Current status indicates the domain is offline, returning a 523: Origin is unreachable error. However, the infrastructure remains registered and could be reactivated. Organizations and users are advised to block the domain and associated IP address 188.114.97.3 at the network perimeter. Security teams should monitor for related domains registered through Namecheap or resolving to the same IP range, as threat actors frequently reuse hosting providers and infrastructure. End-users should be educated on recognizing credential harvesting attempts, particularly those leveraging Cloudflare-protected domains with Let’s Encrypt certificates to appear legitimate.