blassma[.]com

This domain, blassma.com, is flagged as an active credential theft phishing site targeting users through deceptive login portals. Analysis indicates the infrastructure is designed to harvest sensitive authentication details, such as usernames, passwords, and multi-factor authentication codes, which are subsequently exploited for unauthorized account access or sold on underground markets. The elevated risk level stems from the domain's recent deployment, use of evasion techniques, and confirmed malicious activity reported by multiple security sources. Infrastructure analysis reveals the domain was registered on April 17, 2026, through Global Domain Group LLC, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.197.67, a Cloudflare-hosted endpoint that leverages HTTP/3 and Node.js with Express for backend operations, likely to obfuscate the true origin of the phishing server. The site employs a valid SSL certificate issued by Google Trust Services, a tactic commonly used to lend false legitimacy to malicious pages. Detection metrics show the domain appears on one security blocklist and is flagged by 5 out of 95 vendors on VirusTotal, including PhishDestroy, which explicitly blocks it. The page title, 'Attention Required! | Cloudflare,' is a known indicator of phishing campaigns attempting to mimic legitimate security challenges to manipulate user behavior. To mitigate risks associated with this credential theft operation, users are advised to avoid interacting with the domain entirely. If accidental access occurs, immediately terminate the session and refrain from entering any credentials. Organizations should implement network-level blocking for the domain and its associated IP (172.67.197.67) to prevent internal exposure. Multi-factor authentication (MFA) using app-based or hardware tokens is strongly recommended for all accounts, as it reduces the impact of stolen credentials. Additionally, security teams should monitor for anomalous login attempts or unauthorized access patterns, particularly from the identified infrastructure. Regular phishing awareness training, emphasizing the risks of Cloudflare-branded security prompts, can further reduce susceptibility to such attacks.