blackhole[.]app-crypt[.]com

The domain blackhole.app-crypt.com was registered on February 21, 2026 and is currently taken offline. DNS resolution points to the IP address 172.67.183.249, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presented a page title of "BlackHole" and employed an SSL certificate identified as WE1. VirusTotal analysis recorded four detections out of ninety‑three security vendors, indicating limited but notable vendor consensus on malicious behavior.

Independent scoring from Gridinsoft assigned a trust score of zero out of one hundred, reinforcing the assessment of high risk. The domain appears on five public security blocklists and has been actively blocked by multiple anti‑phishing services, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. Threat intelligence tags the site as a crypto scam that impersonates the Coinbase brand, consistent with the "brand target" field.

While the offline status prevents live verification of page content, the available artifacts—such as the brand reference, low trust score, vendor detections, and blocklist listings—provide sufficient evidence to classify the domain as a credential‑stealing infrastructure targeting cryptocurrency users. Defenders should continue to block the domain at network perimeter devices, update endpoint and DNS filtering rules, and monitor for any resurgence of the host or related subdomains. Further investigation could focus on correlating the IP address with other known malicious hosts within the Cloudflare network and reviewing any residual traffic logs for attempted connections before the shutdown.