blockchainbtcmining[.]com

Analysis of blockchainbtcmining.com, created on September 06, 2025 and currently taken offline, indicates a high‑risk brand‑impersonation campaign targeting users of Blockchain.com. The domain is registered through NameSilo, LLC and resolves to the Cloudflare address 172.67.157.208, an IP owned by AS13335 Cloudflare, Inc. The authoritative nameservers are ignat.ns.cloudflare.com and zara.ns.cloudflare.com, confirming the use of Cloudflare’s DNS infrastructure. No SSL certificate is presented, leaving the site without transport‑layer encryption. Google Safe Browsing has flagged the domain for social engineering, and PhishDestroy lists it as blocked.

Additional detection comes from a single AlienVault OTX pulse and one security blocklist, reinforcing its malicious classification. Reputation services assign extremely low scores: Gridinsoft rates it 0/100 and Scamadviser 1/100, reflecting near‑total lack of trust. VirusTotal reports that 13 of 95 scanning engines flagged the domain, consistent with its designation as a crypto‑related scam. The site is identified as impersonating Blockchain.com, aligning with the reported scam type of a crypto scam.

While the exact phishing page content and login flow have not been publicly disclosed, the convergence of multiple independent indicators—Safe Browsing, blocklists, low trust scores, and vendor detections—provides strong evidence of a credential‑ harvesting or fraud operation. Defenders should continue to block the domain at perimeter controls, monitor for any resurgence of the host IP or associated Cloudflare subdomains, and educate end‑users about the risk of unsolicited communications referencing Blockchain.com. Ongoing threat‑intel feeds should be queried for new OTX pulses or additional blocklist entries, and any future registration attempts using similar naming patterns should be pre‑emptively denied.