webtrader[.]inblocks-ai[.]com

PhishDestroy identifies the active domain webtrader.inblocks-ai.com as a generic phishing page impersonating an online trading platform, likely targeting cryptocurrency users seeking portfolio management or asset trading. This domain employs a crypto-related theme ("webtrader") to deceive visitors into connecting their digital wallets under the false pretense of asset or trading functionality. No specific drainer kit or branding spoofing has been confirmed at this stage, but the convergence of domain semantics with high-risk behavior patterns suggests imminent credential theft or wallet draining activities. The infrastructure is provisioned to host a convincing fake UI mirroring legitimate trading dashboards, increasing the likelihood of user interaction and data exposure.

This domain exhibits several concerning technical indicators flagged during forensic analysis. webtrader.inblocks-ai.com resolves to IP address 199.231.235.157 and is registered via NameSilo, LLC, with a creation timestamp of December 31, 2025 — a recent and potentially suspicious date given the absence of historical legitimacy. The SSL certificate, issued by Sectigo Limited, does not mitigate risk as it is commonly abused in phishing campaigns to simulate trust. According to VirusTotal intelligence, the domain currently shows 0 detections out of 95 engines as of real-time scanning, indicating it remains unflagged by most security platforms despite active hosting. While Google Safe Browsing (GSB) status and third-party blocklist participation are not confirmed in this dataset, such low detection rates are consistent with emerging phishing domains designed to bypass early-stage detection systems. The domain’s anonymity-friendly registration and recent creation strongly correlate with malicious intent, warranting immediate scrutiny.

As of this report, the domain remains active and under active monitoring by PhishDestroy’s threat intelligence unit. The current risk level is tagged as "under_investigation," but the absence of detections and presence of suspicious infrastructure suggest escalation potential. Users are strongly advised to avoid visiting webtrader.inblocks-ai.com and to verify any trading-related domains via official sources before interaction. The domain’s block status and associated infrastructures (IP, SSL) should be disseminated to network defense teams and security vendors to preempt mass compromise. Remaining risk is assessed as moderate-to-high due to the combination of novel infrastructure, low detection coverage, and thematic alignment with high-value phishing targets in the cryptocurrency sector. Disruption efforts include domain takedown coordination, IP/SSL blacklisting, and alert distribution to crypto communities.