blk-bull[.]pro

Analysis indicates that the domain blk-bull.pro was registered on July 26, 2026 through PDR Ltd. d/b/a PublicDomainRegistry.com and is presently active. The authoritative nameservers are jacob.ns.cloudflare.com and lina.ns.cloudflare.com, pointing to the Cloudflare network. DNS resolution returns the address 188.114.96.3, which is a Cloudflare‑owned IP range. The domain appears on three independent security blocklists and has been explicitly blocked by PhishDestroy, MetaMask, and SEAL.

VirusTotal reports that two of ninety‑one security vendors have flagged the domain, confirming that at least a minority of scanners have identified malicious behavior. No additional telemetry such as Safe Browsing status, OTX entries, SSL certificate details, or HTTP response codes is available in the current intelligence set. Consequently, the full scope of the phishing infrastructure—including the payload, targeted brand, and victim interaction flow—remains unclear. Defenders should add blk-bull.pro to local deny lists, monitor DNS queries for the associated Cloudflare IP address, and enforce outbound filtering for any traffic to the domain.

Given the recent creation date and active status, continuous observation is advised to detect any escalation, such as the emergence of new detection signatures or inclusion on additional blocklists. Organizations employing email gateways, web proxies, or endpoint protection should ensure that their rule sets reference the known blocklist entries and the specific blocklist identifiers that already list this domain. Early containment can reduce exposure while further investigation clarifies the campaign’s objectives.