register-blackhole[.]xyz

The domain register-blackhole.xyz was registered on February 21, 2026 through OwnRegistrar, Inc. and is currently listed as active with a high risk rating. Intelligence classifies it as a generic phishing infrastructure, and it appears on two public security blocklists. The domain’s unique seed identifier is b5c8ca, which is used to distinguish this campaign from other observed activity.

Technical resolution shows the domain resolving to the IPv6 address 2a06:98c1:3120::3, which is advertised by AS13335 belonging to Cloudflare, Inc. The authoritative nameservers are chip.ns.cloudflare.com and reza.ns.cloudflare.com. HTTP traffic is served through Cloudflare with HTTP/3 enabled and returns a 301 redirect. The TLS certificate presented is issued by Google Trust Services under the WE1 label, confirming a valid HTTPS handshake despite the redirect.

The page title returned by the server is "register-blackhole.xyz | 522: Connection timed out", indicating that the origin server failed to respond within the expected window. VirusTotal analysis records four out of ninety‑five security vendors flagging the domain as malicious, reinforcing the blocklist detections by PhishDestroy and ScamSniffer. No additional content has been captured, so the exact phishing payload or credential‑harvesting page remains unknown.

Defenders should add the IPv6 address 2a06:98c1:3120::3 and both Cloudflare nameservers to network‑level deny lists, and block any outbound or inbound HTTP/S traffic to register‑blackhole.xyz. Continuous monitoring of DNS queries for this domain is advised, as well as periodic re‑scanning with updated threat‑intelligence feeds to capture any changes in payload or hosting. Given the high risk classification, organizations should treat any user‑initiated connections to this domain as potentially compromised and enforce strict endpoint alerts.