blockchainlogin[.]webflow[.]io

The domain blockchainlogin.webflow.io is associated with a credential phishing scheme targeting users of blockchain services. The site, titled 'Blockchain Login - Sign In To Blockchain Account Now,' aimed to deceive users into divulging sensitive login credentials. There is no evidence of a specific drainer kit being employed in this campaign. The domain was designed to mimic legitimate blockchain login pages, potentially deceiving users into submitting their personal information.

Technical indicators include a VirusTotal detection rate of 18 out of 95 security vendors, indicating significant recognition of malicious activities. The domain was registered through NameCheap, Inc., and initially resolved to the IP address 104.18.36.248, which is associated with Cloudflare, Inc. in the United States. The domain was created on February 23, 2026. Despite being offline now, it appeared on one security blocklist and was part of Google's Safe Browsing (GSB) service warnings. The SSL certificate was issued by Google Trust Services, potentially to add a false sense of security to unsuspecting visitors.

Currently, the domain is offline, and it has been blocked by PhishDestroy, reducing immediate risks of further credential theft. However, the potential for similar attempts remains, especially if users do not exercise caution when entering credentials on unfamiliar sites. Continuous monitoring and user education are recommended to mitigate ongoing risks. Users are advised to verify URLs carefully and use only trusted sources for accessing sensitive accounts. Security teams should remain vigilant and ensure that similar phishing attempts are promptly identified and neutralized.