blchrwrd[.]net

Analysis on blchrwrd.net indicates an active malicious infrastructure targeting cryptocurrency users. The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is hosted behind Cloudflare (ASN 13335) with the public IP 172.67.167.164 located in the United States. The site serves an HTTP 301 redirect and presents the page title “Blockchain Reward Program”, consistent with the listed scam type of a crypto‑related phishing campaign. The TLS certificate is issued by Google Trust Services under the WE1 brand, confirming the use of a valid SSL chain despite the malicious intent.

Reputation data shows a Gridinsoft trust score of 0 / 100 and two of ninety‑three VirusTotal scanners flag the domain, reflecting limited but notable detection. The domain appears on one external blocklist and is already blocked by the PhishDestroy feed, indicating that at least one security vendor has taken mitigation action. HSTS, HTTP/3 and Cloudflare services are observed, suggesting the operators are leveraging modern web performance features to increase credibility and evade simple static analysis. Uncertainty remains regarding the exact content served after the redirect, as no visual or form details are available in the current intelligence.

defenders should therefore treat any traffic to blchrwrd.net as hostile. Recommended actions include adding the domain to corporate URL filtering, DNS blocklists, and endpoint protection deny lists, monitoring for any related C2 indicators tied to the Cloudflare IP range, and investigating logs for attempts to access the “Blockchain Reward Program” page. Ongoing observation of the registrar and name‑server records is advised, as changes may indicate further campaign evolution.