veblackholepool[.]xyz

PhishDestroy identifies veblackholepool.xyz as an active typosquatting fraud portal designed to deceive cryptocurrency mining enthusiasts. This domain poses an elevated risk as a generic phishing host specifically targeting users expecting legitimate crypto-mining pools. The infrastructure currently resolves to IP 172.67.180.30 via a Google Trust Services SSL certificate, suggesting an attempt to appear legitimate. VirusTotal flags show 3 out of 95 security vendors have detected malicious content on this domain since its creation. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on August 20, 2025, indicating very recent deployment as part of a coordinated typosquatting campaign against crypto communities. Technical analysis reveals this domain mimics established mining pool branding through slight typographical variations, a common tactic in cryptocurrency fraud. The short domain age combined with low but present detection rates suggests this may be a newly launched threat still building its reputation across security platforms. The presence of a valid SSL certificate further indicates attempts to bypass browser security warnings that typically flag invalid certificates. Current status remains active with continued domain resolution. Users should immediately block veblackholepool.xyz at DNS/network levels and avoid all mining pool-related downloads from this domain. Update security tools with this IOC and consider reporting to relevant cryptocurrency fraud databases. Security teams should monitor for additional domains registered through the same registrar following this pattern.