purstream[.]to

Analysis of purstream.to indicates an active brand‑impersonation campaign targeting the Minecraft brand. The domain was registered on 23 July 2025 through NameCheap, Inc. and uses Cloudflare’s authoritative name servers alice.ns.cloudflare.com and nolan.ns.cloudflare.com. Resolution returns a single IPv6 address (2a06:98c1:3120::3) belonging to AS13335 Cloudflare, Inc., with the hosting location listed as the United States. The site presents the page title “Purstream – Le streaming made in France” and returns an HTTP 301 redirect, served over TLS with a certificate issued by Google Trust Services (WE1). Automated scans on VirusTotal flagged the domain by 2 of 95 security vendors, and Gridinsoft assigns a low trust score of 24/100. The infrastructure incorporates jsDelivr and HTTP/3, consistent with a Cloudflare‑accelerated delivery stack. The domain appears on one public blocklist and has been added to the PhishDestroy blocklist, confirming that security‑focused feeds already recognize the threat. Current evidence does not reveal the exact phishing landing page or credential‑capture mechanisms, so content‑level analysis remains pending. Defenders should block purstream.to at DNS and proxy layers, monitor for outbound connections to its IPv6 address, and update email and web filters to flag any references to the Minecraft brand originating from this domain. Continuous re‑evaluation is advised as additional indicators may emerge.