blockchain-ai-rss-20260323[.]pages[.]dev

This domain, blockchain-ai-rss-20260323.pages.dev, is flagged as a high-risk generic phishing threat targeting users of blockchain and artificial intelligence (AI) RSS feed services. Analysis of the page title, 区块链 AI Agent RSS 每日导读 2026-03-23, indicates an attempt to impersonate legitimate daily digest services for blockchain and AI-related content, likely to deceive users into divulging credentials or downloading malicious payloads. No specific drainer kit signatures have been identified, but the domain exhibits characteristics consistent with credential harvesting or malware distribution campaigns. Infrastructure analysis reveals the domain was registered on March 29, 2026, through Cloudflare, Inc., and currently resolves to the IP address 172.66.47.66. VirusTotal detection metrics show 2 out of 95 security vendors have flagged this domain as malicious. The domain appears on one security blocklist and is actively blocked by at least one threat intelligence feed. The SSL certificate is issued by Let's Encrypt (serial number E7), a common tactic to lend legitimacy to phishing sites. The IP address geolocates to Cloudflare infrastructure in Canada, a frequent hosting choice for threat actors due to its anonymity and resilience. As of the latest assessment, the domain remains active and continues to pose a high risk to users. Response actions include its inclusion on one security blocklist and active blocking by threat intelligence platforms. However, the low detection rate on VirusTotal (2/95) suggests the domain may evade some automated defenses, increasing the risk of successful compromise. Organizations and individuals are advised to block the domain and its associated IP address at the network level. Users should be educated to verify the authenticity of RSS feeds and avoid interacting with unsolicited blockchain or AI-related content from untrusted sources.