provenancefdn[.]com

The domain provenancefdn.com is under investigation for crypto blockchain impersonation, specifically targeting users of the Provenance blockchain platform. Analysis indicates the site masquerades as an official portal for digital real-world asset tokenization, a core function of the legitimate Provenance network. As of the latest assessment, the domain has been taken offline, though prior activity suggests it was operational for malicious purposes. Infrastructure analysis reveals the domain was registered through Dynadot LLC on February 21, 2026, an anomalous creation date likely intended to evade detection by appearing futuristic. It resolves to the IP address 104.21.29.6 and employs Cloudflare for hosting, a common tactic to obscure origin servers and evade geoblocking. The site utilized Plesk, PHP, RequireJS, and Prototype, alongside HTTP/3 for performance optimization. Despite its technical sophistication, the domain holds a Gridinsoft trust score of 0/100 and appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy. Notably, VirusTotal reports 0/95 detections, indicating low initial visibility among antivirus vendors despite its presence on specialized threat feeds. The SSL certificate is issued by Google Trust Services, providing a veneer of legitimacy while failing to mitigate the underlying malicious intent. Current evidence suggests this domain was designed to deceive users into interacting with fraudulent smart contracts or wallet-draining mechanisms, a hallmark of crypto-focused phishing operations. Given its offline status, the immediate threat is mitigated, but the infrastructure may resurface under a different domain or IP configuration. Organizations and individuals are advised to monitor for similar impersonation attempts, particularly those leveraging blockchain terminology or branding. Network defenders should block the IP 104.21.29.6 and domain provenancefdn.com at the perimeter, while users should verify the authenticity of any Provenance-related communications through official channels. Security teams are encouraged to review logs for prior connections to this domain and investigate potential exposure to crypto wallet-draining schemes.