terzer-iostarrt[.]webflow[.]io

This domain, terzer-iostarrt.webflow.io, is flagged as an active crypto credential theft operation targeting Web3 and cryptocurrency users. Analysis indicates the site employs social engineering tactics to trick victims into entering wallet credentials, private keys, or seed phrases under the guise of a legitimate service. The page title, terzer.iostarrt, suggests an attempt to mimic or spoof a cryptocurrency platform, though no direct brand impersonation is confirmed. No specific drainer kit signatures have been identified in initial scans, but the domain exhibits characteristics consistent with credential harvesting infrastructure. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 104.18.36.248 and is hosted on a content delivery network with an SSL certificate issued by Google Trust Services. The domain was registered on May 8, 2013, through MarkMonitor, Inc., though the malicious subdomain appears to have been recently activated. As of the latest scan, VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious. The domain appears on three security blocklists and is actively blocked by at least three Web3-focused security providers. Google Safe Browsing status is not explicitly listed, but the presence on multiple blocklists indicates broad detection. Current status remains active, with no evidence of takedown or remediation. The domain continues to resolve and serve content, posing an ongoing risk to users who may encounter it through phishing links in emails, social media, or malicious advertisements. Response actions should include immediate blocking of the domain and IP at the network level, as well as monitoring for related subdomains or IPs associated with the same infrastructure. Users are advised to verify domain authenticity before entering any credentials and to employ hardware or software-based wallet protections. The risk level remains high due to the domain's active status and its targeting of cryptocurrency assets.