blockchain-tool[.]web[.]app

This domain, blockchain-tool.web.app, is currently offline but historical evidence indicates it was used for a brand‑impersonation campaign targeting users of Blockchain.com. Registration data shows the domain was created through Google LLC, and the hosting infrastructure is served via Fastly (AS54113) in the United States, resolving to IP address 199.36.158.100. The site employed Firebase with HSTS and HTTP/3, and presented a Google Trust Services certificate (WR4), which is consistent with legitimate Google‑hosted services and can lend credibility to malicious pages. The only visible page title returned a generic “Welcome to our website” and the HTTP response was a 404, suggesting the landing page was removed before analysis.

Scamadviser assigned a trust score of 1 out of 100, classifying the site as a crypto scam. VirusTotal scans flagged the domain in five of ninety‑five antivirus engines, and it appears on two external blocklists operated by PhishDestroy and ScamSniffer. The domain explicitly impersonates Blockchain.com, a well‑known cryptocurrency wallet provider, and is labeled as a crypto‑scam type in the intelligence feed. Uncertainty remains regarding the exact phishing payload, credential‑stealing forms, or malicious binaries that may have been delivered before the takedown, as no content snapshot is available.

Defenders should continue to block the domain at DNS and proxy layers, monitor Fastly‑associated IP ranges for similar abuse, and add the domain hash to internal threat‑intel feeds. Network traffic to the IP should be logged and any attempts to resolve the hostname should be denied. Because the SSL certificate is valid for Google services, reliance on certificate validation alone is insufficient; correlation with the low trust score, blocklist entries, and the brand‑impersonation tag provides a strong indicator of malicious intent.