m[.]blockchainmusdc[.]com

The domain m.blockchainmusdc.com was registered on 21 February 2026 through Gname.com Pte. Ltd. and resolves to the IP address 188.114.97.3, which is part of AS13335 operated by Cloudflare, Inc. The hosting infrastructure is provided by Cloudflare, utilizes HTTP/3, and presents a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS endpoint. An HTTP request returns a 403 status code, and the domain is currently reported as offline. VirusTotal analysis shows that 13 of 93 scanned security vendors flag the domain as malicious, and it appears on one security blocklist. The domain has been blocked by PhishDestroy, and Google Safe Browsing classifies it as social engineering.

The server returns a page title of “Bitcoin Blockchain,” matching the reported scam type of a crypto scam, and the intelligence explicitly notes that the site impersonates the brand “foundation.” Known indicators include the registrar Gname.com Pte. Ltd., the nameservers augustus.ns.cloudflare.com and kallie.ns.cloudflare.com, and the Cloudflare‑provided IP address. No content snapshot is available, so the exact phishing page layout, credential‑collection mechanisms, or any malicious payloads remain unverified. The limited blocklist presence and the domain’s offline status constrain real‑time analysis, but the combination of brand impersonation, crypto‑scam labeling, and the observed security vendor detections suggest a high‑risk threat.

Defenders should continue to block the hostname at DNS and perimeter filters, add the domain to internal watchlists, and monitor for any resolution changes. Since Cloudflare hosts many legitimate sites on the same IP range, any blocking actions should be scoped to the specific hostname and associated TLS certificate.