black-whale[.]fun

The domain black-whale.fun was observed on July 12, 2026. It is currently active and assigned a high risk rating. The site returns HTTP 200 and presents the page title “The Black Whale | $BlackWhale Memecoin on Solana”, indicating a direct reference to the Solana ecosystem. Technical investigation shows the domain was registered on February 21, 2026 through NameCheap, Inc. and uses the authoritative name servers dns1.namecheaphosting.com and dns2.namecheaphosting.com. DNS resolution points to IP 68.65.122.53, which belongs to AS22612 Namecheap, Inc. and is geolocated in the United States. The server presents a Sectigo RSA Domain Validation certificate issued by Sectigo Limited and runs LiteSpeed web server software. The infrastructure has already been listed on four security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—and received a Gridinsoft trust score of 0 out of 100. VirusTotal analysis indicates that five of ninety‑five scanners flagged the domain, reinforcing the malicious assessment. An MX record for mail.black-whale.fun exists with priority 0, suggesting that the operator may be capable of sending email communications that appear to originate from the same domain. Analysis indicates that the site is being used for brand impersonation of Solana, likely to lure cryptocurrency users into interacting with a fraudulent memecoin offering. The exact content of the page, any credential‑capture mechanisms, or downstream payloads have not been publicly disclosed, leaving the full scope of the attack uncertain. Defenders should therefore treat any traffic to black‑whale.fun as hostile. Mitigation steps include adding the domain and its IP address to network deny lists, configuring email gateways to reject or quarantine messages from mail.black-whale.fun, and monitoring DNS queries for the associated name servers. Continuous re‑assessment is advised, as the operator could modify the site or redeploy additional infrastructure.