app-blackhole-v2[.]com

app-blackhole-v2.com is flagged as a brand‑impersonation site targeting the cryptocurrency wallet provider Across. The domain was registered on 29 September 2025 through NiceNIC International Group Co., Limited and resolves to the Cloudflare address 188.114.96.3, ASN 13335 (Cloudflare, Inc.) located in the United States. Both authoritative nameservers (terry.ns.cloudflare.com and ximena.ns.cloudflare.com) belong to Cloudflare, indicating that the infrastructure is fully delegated to the provider. No TLS certificate is present, so the site does not offer HTTPS encryption. The page title returned by the HTTP response reads “Blackhole Protocol: Token Burn & Deflationary Mechanics for Crypto,” which aligns with the declared scam type of wallet/seed phishing and suggests an attempt to lure victims with a token‑burn narrative.

Reputation checks show a Gridinsoft trust score of 0 / 100 and a single inclusion on a security blocklist. VirusTotal analysis recorded one positive detection out of 95 scanning engines, confirming that at least one AV product identified malicious behavior. PhishDestroy also lists the domain as blocked, corroborating the phishing classification. The current HTTP status is offline, and the site is not serving content at the time of assessment, limiting direct observation of malicious payloads.

Evidence points to a classic impersonation workflow: a newly‑registered domain, Cloudflare‑hosted infrastructure, lack of TLS, and a crypto‑focused title designed to entice users into exposing private keys or seed phrases. Defenders should add the domain to web‑filter and DNS blocklists, monitor for additional domains using the same Cloudflare nameservers or similar title patterns, and enforce strict verification of any wallet‑related communications purporting to originate from Across. Because the site is presently offline, continuous re‑probing is advisable to capture any re‑activation attempts.