https-blsp-at[.]cc

Analysis of the domain https-blsp-at[.]cc indicates it is an active phishing endpoint under investigation as of July 12, 2026. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. Infrastructure analysis reveals the domain resolves to IP address 104.21.87.223, which is part of Cloudflare's network, a common obfuscation tactic used to conceal the true origin of malicious traffic. The site employs HSTS and HTTP/3, suggesting an attempt to appear legitimate while leveraging modern web technologies to evade detection. Current threat intelligence sources show mixed signals regarding its classification. While no detections are recorded by 95 vendors in recent scans, the domain appears in 22 threat intelligence pulses on AlienVault OTX and is listed on two security blocklists. It is actively blocked by at least two security mechanisms, indicating confirmed malicious activity. The Gridinsoft trust score of 96/100 further supports its classification as high-risk. The SSL certificate is issued by Google Trust Services, which does not inherently validate the domain's legitimacy but ensures encrypted connections, a common requirement for phishing sites to avoid browser warnings. The exact nature of the phishing campaign remains unconfirmed, as no specific brand, login portal, or scam type has been identified in available data. Defenders should treat this domain as an active threat, particularly given its persistence since registration and its presence on multiple blocklists. Network-level blocking of 104.21.87.223 and monitoring of related subdomains under https-blsp-at[.]cc is recommended. Further investigation into the domain's hosting infrastructure and associated registrant details may provide additional context for attribution or takedown efforts.