blyatman[.]xyz

This domain, blyatman.xyz, is currently under investigation for generic phishing activity aimed at harvesting user credentials or sensitive data. Analysis indicates no direct association with a specific brand or known phishing kit, though the infrastructure aligns with common credential-theft campaigns. The domain presents a 404 Not Found error, suggesting either a takedown, temporary deactivation, or cloaking behavior to evade detection during inactive periods. Infrastructure analysis reveals the following technical indicators: the domain was registered on March 29, 2021, through NameSilo, LLC, and resolves to the IP address 172.67.147.90, which is associated with Cloudflare services. Despite its low detection rate on VirusTotal (0/95), it appears on one security blocklist and has a Gridinsoft trust score of 45/100. The SSL certificate is issued by Google Trust Services, a common feature in phishing domains to mimic legitimacy. Technologies detected include Cloudflare and HTTP/3, which may be leveraged to obfuscate malicious traffic or improve resilience against takedowns. Currently, blyatman.xyz is offline, likely due to enforcement actions such as blocking by PhishDestroy or registrar intervention. However, the domain remains registered and could be reactivated at any time. The absence of detections on VirusTotal does not eliminate risk, as phishing domains often evade initial scans through cloaking or delayed malicious payloads. Users and organizations are advised to maintain blocklist enforcement, monitor for DNS resolution changes, and treat any future activity from this domain as high-risk until further analysis confirms remediation.