nansen-ai[.]webflow[.]io

This domain, nansen-ai.webflow.io, is identified as a phishing resource impersonating the legitimate Nansen cryptocurrency analytics platform. Analysis indicates the site is designed to harvest user credentials, API keys, or wallet recovery phrases by presenting a fraudulent interface mimicking the official Nansen portal. The threat actor leverages social engineering tactics, exploiting the trust associated with the Nansen brand to deceive victims into divulging sensitive authentication details. Given the domain's focus on cryptocurrency users, the potential impact includes unauthorized access to digital assets, financial theft, and identity compromise within blockchain ecosystems. Infrastructure analysis reveals the domain was registered through NameCheap, Inc., with a creation date of February 22, 2026, suggesting either a typo-squatting strategy or an attempt to exploit future brand recognition. The domain resolves to the IP address 172.64.151.8, hosted behind Cloudflare infrastructure, which is commonly abused to obfuscate malicious activity and evade detection. As of the latest assessment, the domain appears on three security blocklists and is flagged by 3 out of 95 security vendors on VirusTotal, indicating a moderate but elevated risk profile. The SSL certificate is issued by Google Trust Services, which, while legitimate, does not mitigate the underlying phishing threat. Detection by multiple cryptocurrency-specific security mechanisms further corroborates the domain's malicious intent. Users who have interacted with nansen-ai.webflow.io are advised to take immediate remedial actions. First, revoke any permissions granted to applications or services linked to the domain, particularly within cryptocurrency wallets or exchange accounts. Second, rotate credentials for all platforms where identical or similar login details may have been reused, prioritizing financial and blockchain-related services. Third, monitor accounts for unauthorized transactions or anomalous activity, and report any suspicious findings to the respective platform's security team. If wallet recovery phrases or private keys were entered, consider migrating assets to a new wallet to mitigate the risk of permanent compromise. Organizations should update internal blocklists to include this domain and its associated IP address to prevent further exposure.