babybliss[.]com[.]co

Analysis of babybliss.com.co indicates active brand impersonation targeting American Express, classified as a high-risk domain. The domain was registered on September 27, 2025, through Tucows Domains Inc. and remains operational as of July 12, 2026. Infrastructure reveals resolution to IP 23.227.38.32, a Shopify-hosted address commonly associated with e-commerce platforms, though no direct confirmation of Shopify misuse exists. The site employs Cloudflare for traffic routing, HSTS for enforced HTTPS, and a Let's Encrypt SSL certificate, which collectively obscure origin details and enhance perceived legitimacy. The page title, 'Babybliss – BabyBliss,' does not align with financial services, suggesting either misdirection or a placeholder during development. Security vendor detection is limited, with only 1 of 95 engines on VirusTotal flagging the domain, though this does not preclude malicious intent. The domain appears in 23 threat intelligence pulses on AlienVault OTX and is blocked by two security blocklists, including PhishDestroy and BLP-Malware. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. Defenders should treat this domain as actively malicious, particularly in environments where American Express branding is relevant. Immediate actions include blocking the domain and IP at perimeter controls, monitoring for internal connections, and reviewing logs for prior exposure. Further analysis of the site's content is required to determine the exact phishing mechanism, though the brand impersonation context is sufficient to justify containment measures.