Analysis of the domain black-url.cyou, created on July 25 2026 and currently active, shows it resolves to the IPv4 address 188.114.97.3. The domain is delegated to Cloudflare name servers adel.ns.cloudflare.com and javon.ns.cloudflare.com, indicating the use of Cloudflare's DNS and possibly its CDN services. Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED. No further WHOIS privacy details are provided.
The domain appears on a single public blocklist, PhishDestroy, which classifies it as malicious. VirusTotal has processed the domain with 91 scanning engines; at the time of the latest scan none reported a detection. No additional detections are observed in Google Safe Browsing, OTX, or other reputation services according to the available data. SSL/TLS certificate information, HTTP response codes, page title, and content analysis are not presently available, limiting the ability to confirm the presence of a phishing landing page.
The short lifespan of the domain (registered only three days prior to the report) combined with its inclusion on a phishing blocklist suggests a deliberate, likely short‑term campaign. Defenders should treat the domain as hostile: block network connections to 188.114.97.3, add black-url.cyou to URL filtering policies, and monitor for any traffic patterns that reference the domain. Continuous re‑evaluation is recommended, as further analysis (e.g., retrieval of the landing page, certificate inspection, and monitoring of additional blocklists) may reveal more indicators of compromise.