blockchainsupportlive[.]netlify[.]app

On 24 July 2026 analysts observed the domain blockchainsupportlive.netlify.app returning HTTP 404 and presenting the page title “Rectification”. The site was hosted on Netlify, as indicated by the presence of Netlify‑specific headers and the HSTS policy, and its authoritative name servers are dns1.p04.nsone.net and dns2.p04.nsone.net. DNS resolution points to the IP address 35.157.26.135, which belongs to Amazon’s AS16509 infrastructure located in Germany. The TLS certificate presented is a DigiCert Global G2 RSA SHA‑256 certificate issued in 2020 by DigiCert Inc., confirming that the connection was encrypted despite the site being offline. The domain is explicitly listed as impersonating the legitimate brand Blockchain.com and is classified as a crypto‑related scam.

It appears on five independent security blocklists and is actively blocked by the vendors PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal scans reported five detections out of ninety‑five scanners, reinforcing the malicious assessment. Registration details show the domain was provisioned through Netlify’s automated registration service, which is consistent with the hosting evidence. While the HTTP 404 response indicates the page is no longer serving content, the infrastructure artifacts—hosted on a reputable cloud provider, use of a valid SSL certificate, and the presence of brand‑specific impersonation metadata—suggest the domain was previously employed in a credential‑harvesting or fraudulent transaction flow targeting users of Blockchain.com.

No additional content, such as login forms or phishing pages, has been captured, leaving the exact user‑interaction vector uncertain. Defenders should continue to block the domain at network perimeter and DNS layers, monitor for any re‑activation of the host on the same IP range, and update brand‑specific threat feeds for Blockchain.com with the observed indicator set.