cupsey[.]net

This domain, cupsey.net, is under active investigation for involvement in a delivery scam operation. Registered on July 20, 2026, through TUCOWS.COM, CO., the domain currently resolves to the IP address 188.114.96.3, which is associated with Cloudflare infrastructure, as indicated by its nameservers (alexa.ns.cloudflare.com and maciej.ns.cloudflare.com). The use of Cloudflare nameservers is common among both legitimate and malicious domains, providing anonymity and resilience against takedowns. At present, the domain appears on one security blocklist, specifically PhishDestroy, which suggests preliminary detection of suspicious activity, though the exact nature of the threat remains unverified. Analysis of available data reveals no detections from the 95 vendors that scanned the domain on VirusTotal, though this absence does not confirm the domain's safety or legitimacy. The domain's creation date aligns with the report date, indicating it is newly established, which is a common tactic among threat actors to evade detection and establish short-lived infrastructure. No additional details regarding the domain's content, such as page titles, brand impersonation, or specific scam mechanics, are currently available for analysis. Defenders are advised to treat this domain with caution due to its presence on a security blocklist and its association with a known scam type. Monitoring for further detections, changes in resolution, or additional blocklist inclusions is recommended. Network-level blocking or alerting based on the domain's current IP and nameserver associations may be prudent until further intelligence is gathered. Given the domain's active status and lack of widespread detection, continued investigation is necessary to determine its full scope and intent.