claim-blackholedex[.]xyz

Analysis of claim-blackholedex.xyz indicates that it was operated as a crypto‑drainer scam. The domain was registered on 27 September 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and uses Cloudflare’s DNS infrastructure (brenna.ns.cloudflare.com, christian.ns.cloudflare.com). DNS resolution points to IP 172.67.169.239, which belongs to AS13335 Cloudflare, Inc. in the United States. No TLS certificate is presented, meaning the site served HTTP only. The page title returned by the server is “Blackhole”, matching the reported scam theme. The site was flagged by multiple detection sources.

PhishDestroy listed the domain as blocked, and it appears on one additional security blocklist. On AlienVault OTX the domain is referenced in a single threat‑intelligence pulse. VirusTotal scans show that eight of ninety‑five AV engines flagged the domain, indicating a moderate level of detection across vendors. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment. As of the report date (24 July 2026) the domain is reported offline, and the current HTTP status is unavailable. Because the site is no longer reachable, active probing is limited to historical DNS and blacklist data.

Uncertainty remains regarding the exact payload or transaction flow used to drain cryptocurrency, as no sample of the landing page or malicious script has been captured. Defenders should continue to block claim‑blackholedex.xyz at the network perimeter and update endpoint allow‑lists to reflect the eight VirusTotal detections. Monitoring of the hosting provider’s IP range (172.67.0.0/16) is advisable, as Cloudflare often hosts multiple abusive actors. Threat‑intel feeds that reference the domain, including the OTX pulse and the PhishDestroy blocklist, should be ingested to enrich correlation rules. Given the absence of SSL, any future re‑use of the domain would be trivially observable in clear text, allowing rapid detection.