starry-blast-fire[.]click

The domain starry-blast-fire.click is currently active and has been classified as a high‑risk brand‑impersonation campaign targeting the Blast brand. The site returns an HTTP 302 redirect and presents the page title “Crazy Chicken,” which does not correspond to any legitimate Blast service. VirusTotal records show four out of ninety‑five scanners flagging the domain as malicious, and Gridinsoft assigns a trust score of 0 / 100, confirming a strong malicious posture. The domain was registered on 15 August 2025 through Dynadot, LLC and is served by Cloudflare’s network (AS13335) from the United States, resolving to IP 188.114.96.3. Authoritative name servers are aiden.ns.cloudflare.com and sierra.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and protection services. The site presents a Google Trust Services / WE1 SSL certificate, which is commonly issued to legitimate sites but does not mitigate the observed abuse. Technical fingerprints reveal the presence of OneSignal, jQuery, Cloudflare Browser Insights, and HTTP/3, suggesting a modern web stack that may be used to deliver malicious payloads or harvest credentials. The domain appears on a single security blocklist and is blocked by the PhishDestroy feed, showing that at least one threat‑intel source has incorporated it into defensive controls. The 302 redirect behavior could be employed to funnel victims to a credential‑harvesting endpoint after the initial landing page. Defenders should add starry‑blast‑fire.click to URL filtering and domain‑allow‑list exclusion rules, monitor DNS queries for the Cloudflare name servers, and enforce SSL inspection to capture the redirect chain. Incident response teams should treat any traffic to this domain as malicious, isolate affected endpoints, and advise users that any request for Blast credentials on this site is fraudulent. Ongoing observation of the IP address and any associated subdomains is recommended to detect potential expansion of the campaign.