blockchainmax[.]xyz

Analysis of blockchainmax.xyz indicates a crypto-themed phishing domain targeting Blockchain.com users, first registered on July 22, 2025. The domain resolved to IPv6 address 2a02:26f0:480:5a6::1771, hosted on Akamai International B.V. infrastructure (AS20940, DE). No SSL certificate was present at the time of assessment. The domain was flagged by 5 of 95 security vendors on VirusTotal and appeared in one AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious recognition.

It was also listed on one security blocklist and actively blocked by PhishDestroy. Trust scores from Scamadviser (1/100) and Gridinsoft (0/100) further corroborate its fraudulent classification, with the domain explicitly labeled as a crypto scam in available threat intelligence. Infrastructure analysis reveals the domain was registered through GMO Internet, Inc., with nameservers ns5.afternic.com, ns6.afternic.com, and a verification-specific nameserver (verification-gakbzzzqmt6gkcplw4efpp.ns101.veri). The page title, matching the domain name (blockchainmax.xyz), provides no additional context beyond the impersonation attempt.

As of July 24, 2026, the domain is offline, though its prior hosting on a major CDN and use of IPv6 may indicate attempts to evade traditional IP-based blocking mechanisms. Defenders should treat this domain as confirmed malicious, particularly in environments where Blockchain.com services are accessed. The absence of SSL and the use of a verification-specific nameserver may serve as additional detection criteria. While the domain is currently inactive, monitoring for re-registration or related infrastructure (e.g., subdomains, shared IPs, or nameserver reuse) is recommended due to the elevated risk of re-emergence in similar campaigns.