bluwhale-checker[.]xyz

Analysis indicates that the domain bluwhale-checker.xyz was registered on 17 October 2025 via PDR Ltd. d/b/a PublicDomainRegistry.com and is serviced by Cloudflare DNS (may.ns.cloudflare.com, zac.ns.cloudflare.com). The authoritative address resolves to the IPv6 host 2606:4700:3035::ac43:d6a1, which belongs to AS13335 Cloudflare, Inc., located in the United States. No TLS certificate was observed, suggesting the site operated over plain HTTP at the time of takedown. The page title returned by the server was “Un momento…”, and the domain is currently offline.

Reputation services assign extremely low trust scores (Scamadviser 1/100, Gridinsoft 0/100). The domain appears on two public blocklists and has been indexed by at least two dedicated phishing detection services, PhishDestroy and ScamSniffer. VirusTotal analysis recorded ten positive detections out of ninety‑five scanned security vendors, reinforcing the malicious classification. Additionally, AlienVault OTX references the domain in a single threat‑intel pulse.

The evidence collectively points to a generic phishing operation, but the lack of captured payload or a specific target brand prevents precise attribution of the fraud vector. Defenders should continue to block the domain at the network perimeter, update DNS‑based blacklists with the observed IPv6 address, and monitor for any resurgence using the same registrar or Cloudflare name servers. Ongoing observation of the registrar’s bulk registration patterns may reveal further malicious domains. Until further forensic artifacts become available, the domain remains classified as elevated risk.