recttiblockchain[.]xyz

The domain recttiblockchain.xyz is a confirmed phishing site engaged in brand impersonation targeting Blockchain.com users. It presents itself as a legitimate cryptocurrency platform to deceive victims into connecting wallets or participating in fake airdrops, leading to potential financial theft. No drainer kit was identified, but the site operated as an airdrop scam and wallet-connect phishing page. As of the latest verification, recttiblockchain.xyz has been taken offline.

Technical indicators confirm the malicious nature of recttiblockchain.xyz. The domain was flagged by 2 of 95 security vendors on VirusTotal, including alphaMountain.ai and Forcepoint ThreatSeeker. It appears on 4 security blocklists, including PhishDestroy, Polkadot, Enkrypt, and Codeesura. Registered through HOSTINGER operations, UAB on August 25, 2025, the domain resolved to IP address 148.135.128.172, hosted by Hostinger International Limited in the US. No SSL certificate was present, and the observed page title was 'Rectification'. Nameservers were ns1.dns-parking.com and ns2.dns-parking.com, with a Gridinsoft trust score of 0/100.

Victims of recttiblockchain.xyz should immediately revoke any token approvals granted to the site via wallet management tools like Etherscan or BscScan. Transfer remaining funds to a new, secure wallet and monitor transaction history for unauthorized activity. If credentials were entered, change passwords on the legitimate Blockchain.com platform and enable two-factor authentication. Report the phishing domain to Google Safe Browsing, the impersonated brand’s abuse team, and local cybercrime authorities to aid in takedown efforts.