app-blackhole[.]com

Analysis of app-blackhole.com shows that the site responded with HTTP 200 and presented the page title “Blackhole”. The domain is hosted behind Cloudflare’s network (AS13335) and resolves to 188.114.97.3, a Cloudflare‑owned address located in the United States. The TLS certificate is issued by Google Trust Services under the WE1 root, indicating a valid HTTPS configuration despite the malicious intent. Registration details reveal that Dynadot LLC created the domain on 21 February 2026, and the authoritative nameservers are nicole.ns.cloudflare.com and rodrigo.ns.cloudflare.com. Reputation scoring from Gridinsoft assigns a zero‑point trust rating (0/100).

VirusTotal scans report that 11 of 91 antivirus engines flagged the domain, confirming it as malicious. At least seven independent blocklists have already listed the host, and it is currently blocked by commercial filtering services including PhishDestroy, MetaMask, ScamSniffer, Polkadot, and SEAL. Detected technologies include Cloudflare’s HTTP/3 support, suggesting the operator is leveraging modern transport protocols to improve performance or evade detection. The site is now taken offline, but the infrastructure—particularly the use of Cloudflare’s edge and a recent registration—matches patterns observed in other fast‑flux or low‑TTL phishing campaigns.

What remains unclear is the exact victim brand or credential‑harvesting template used, as the page content has not been captured beyond the title. Defenders should continue to block the domain at network perimeter and update any URL filtering lists. Incident responders should monitor for re‑registration of the same name or similar sub‑domains, and consider hunting for related activity on the same IP address or Cloudflare account. Threat intelligence feeds should be refreshed to incorporate the latest blocklist entries, and any ongoing investigations should reference the 11‑engine VirusTotal detection as corroborating evidence of malicious intent.