blockchain-nodetool[.]web[.]app

On 25 July 2026 the domain blockchain-nodetool.web.app was observed serving a single page titled “Welcome to our website”. The site was hosted on Google’s Firebase platform, employed HTTP Strict Transport Security and HTTP/3, and presented a TLS certificate issued by Google Trust Services under the WR4 intermediate. DNS resolution pointed to IP address 199.36.158.100, which belongs to AS54113 Fastly, Inc. and is geolocated in the United States. Registration records indicate the domain was created through Google LLC, consistent with the use of Firebase hosting. An HTTP request returned a 404 status code, and the site is currently taken offline.

Threat intelligence classified the domain as a brand-impersonation campaign targeting Blockchain.com, with a declared crypto‑scam motive. Two of ninety‑five antivirus and URL‑reputation engines on VirusTotal flagged the domain, and it appears on two independent blocklists, PhishDestroy and ScamSniffer. The elevated risk rating reflects the combination of a trusted hosting provider, a valid TLS certificate, and the use of a brand name in the domain path, which can increase user trust despite the lack of a visible login interface. No additional subdomains or redirects were identified, and the lack of a login form suggests the campaign may rely on social engineering through external communications that direct victims to the short URL. Defenders should add the fully qualified domain name to network‑level deny lists and monitor outbound DNS queries for the associated IP address 199.36.158.100.

Because the hosting service is shared, other Firebase‑based sites may resolve to the same IP, so alerts should be scoped to the exact domain string. Continuous re‑scanning on VirusTotal or similar aggregators is advisable to capture any future detection changes.