blackholetrade[.]xyz

Analysis of blackholetrade.xyz, created on 21 February 2026 via NiceNIC International Group Co., Limited, shows a newly registered domain that has already been associated with a generic phishing campaign. The domain resolves to 172.67.188.169, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. Cloudflare’s DNS service is indicated by the authoritative nameservers coby.ns.cloudflare.com and coco.ns.cloudflare.com, and the site employed Cloudflare Browser Insights and HTTP/3, confirming the use of Cloudflare’s edge platform. The SSL certificate presented is issued by Google Trust Services under the WE1 root, a legitimate certificate chain that does not, by itself, imply trustworthiness.

The only visible page element returned a title of “Just a moment…”, a common placeholder used by Cloudflare when a challenge page is presented; no further content was retrieved before the service was taken offline. The domain received a Gridinsoft trust score of 0/100, indicating the lowest possible confidence. It is currently listed on one security blocklist and has been actively blocked by the PhishDestroy service. VirusTotal analysis recorded five detections out of ninety‑five scanners, confirming that multiple security engines have flagged the domain as malicious.

Because the site is offline, active payloads or credential‑harvesting pages cannot be inspected, and the exact phishing lure remains unknown, limiting attribution. Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resolves to the same IP range, and add the domain to internal blocklists. Threat‑intel teams should treat any future appearances of the same domain or its subdomains as malicious until a thorough re‑analysis confirms otherwise, and maintain observation of Cloudflare‑associated IPs that have been flagged by multiple vendors.