dailybest[.]pro

Analysis of dailybest.pro, observed as a brand‑impersonation campaign targeting Blizzard, indicates that the domain was registered on 23 July 2025 through NiceNIC International Group Co., Limited. The site resolves to the IPv4 address 185.141.27.144, which belongs to the Netherlands under ASN 60117 operated by Host Sailor Ltd. No TLS certificate is presented, meaning the site is served only over HTTP. Gridinsoft assigns a trust score of 0 out of 100, reflecting a complete lack of confidence in the host. The domain is currently listed as offline, and the phishing‑specific blocklist PhishDestroy has already blocked it; it also appears on a single external blocklist.

VirusTotal reports that one of ninety‑five scanned security vendors flagged the domain, confirming at least minimal detection by independent scanners. The page title retrieved from the live endpoint reads “Esports teams and events stats: Dota 2, LoL, CS:GO | Esports”, which does not reference Blizzard and suggests the content is unrelated to the targeted brand, a common tactic to lure victims through unrelated themes. The limited visibility of the infrastructure—only a single nameserver and a solitary blocklist entry—leaves many operational details unknown, including any underlying phishing kit or credential‑collection endpoints.

Defenders should continue to monitor the IP address 185.141.27.144 for any re‑activation, update local blocklists to include dailybest.pro, and enforce strict HTTP‑only filtering for the domain. Given the low trust score and the presence of at least one vendor detection, the domain should be treated as malicious pending further investigation. Organizations using Blizzard services should educate users about unexpected links that reference unrelated esports content and advise verification of URL authenticity before credential entry.