blessnetwork[.]xyz

Analysis indicates that the domain blessnetwork.xyz was registered on 21 February 2026 and presently resolves to the IP address 104.21.80.1, which belongs to AS13335 operated by Cloudflare, Inc. The hosting location is the United States. The site presented the page title “Bless Dashboard” before being taken offline. The SSL certificate presented for the domain is identified as “WE1”, confirming that transport‑layer encryption was in place at the time of observation. VirusTotal recorded 2 detections out of 95 scanning engines, indicating that a minority of security vendors flagged the domain as malicious. In addition, the domain is listed on one public security blocklist and is actively blocked by the PhishDestroy service, reinforcing the classification of the site as a malicious resource.

Intelligence sources label the activity as a crypto‑related scam that impersonates the Coinbase brand, suggesting that the adversary intended to lure victims into a cryptocurrency‑focused deception. The current HTTP status is reported as offline, implying that the content has been removed or the hosting has been terminated. While the available evidence confirms the presence of brand impersonation and the use of a Cloudflare‑provided infrastructure, several aspects remain unverified. No detailed analysis of the page content, login forms, or underlying phishing kit has been published, and there is no publicly disclosed Safe Browsing or Open Threat Exchange (OTX) entry for the domain. The registrar information has not been disclosed, and the trust scores from commercial reputation services are not available in the current dataset.

Consequently, defenders must rely on the observable indicators—domain name, IP address, SSL certificate fingerprint, detection count, blocklist inclusion, and page title—to construct mitigation rules. Recommended defensive actions include adding blessnetwork.xyz and its resolved IP 104.21.80.