bloxlink[.]us

Analysis of bloxlink.us indicates a confirmed brand impersonation campaign targeting Discord users, operational as of July 23, 2026. The domain was registered on December 16, 2025, through NameCheap, Inc., and currently resolves to IP address 104.21.89.157, hosted on Cloudflare's infrastructure (AS13335). No SSL certificate is present, increasing the risk of unencrypted credential interception. The page title 'Bloxlink' aligns with known Discord-related services, though the exact content and functionality of the site remain unconfirmed due to its offline status at the time of this report.

Threat intelligence platforms have flagged the domain with high confidence: AlienVault OTX lists it in three distinct pulses, while Scamadviser and Gridinsoft both assign a trust score of 1/100. VirusTotal reports detection by 15 of 93 security vendors, and the domain appears on at least one security blocklist, specifically PhishDestroy. The absence of an SSL certificate and the use of Cloudflare nameservers (chuck.ns.cloudflare.com, nancy.ns.cloudflare.com) are consistent with phishing infrastructure patterns, though not definitive proof of malicious intent alone. Defenders should treat this domain as high-risk for Discord credential theft or account compromise.

Blocking the domain and its associated IP (104.21.89.157) at perimeter security controls is recommended. Given its offline status, further monitoring of the domain's DNS records and SSL certificate issuance is advised to detect potential reactivation. No evidence suggests the use of a phishing kit or additional infrastructure, but historical patterns indicate this domain may re-emerge with updated hosting or encryption.