provenanceblockchain[.]webflow[.]io

PhishDestroy identifies provenanceblockchain.webflow.io as an active crypto-draining site currently masquerading as the legitimate Provenance Blockchain network. This impostor domain is engineered to trick cryptocurrency holders into connecting wallets and signing malicious transactions that silently drain funds to attacker-controlled addresses. Victims typically arrive via social-media links or spoofed emails promising early access to new tokens or staking rewards; once connected, the drainer requests signature approvals that authorize token transfers without further confirmation. Security telemetry shows the site is already live and resolving to an abused Cloudflare IP, with traffic blocked by MetaMask’s built-in phishing list and the SEAL consortium blocklist, indicating widespread detection by multiple defenses. This domain was flagged by three separate security vendors on VirusTotal out of 95 total scanners, giving it a low-but-elevated detection rate. The site hides behind a Google Trust Services SSL certificate to appear legitimate, yet its infrastructure is freshly routed through 172.64.151.8, a Cloudflare range repeatedly abused for phishing and crypto-draining campaigns. Registrar records and historical DNS analysis suggest the subdomain was created within the last 90 days, likely as a disposable staging ground for a concentrated credential- and fund-harvesting operation targeting Provenance Blockchain users. If you visited provenanceblockchain.webflow.io—or any page that asked you to connect a wallet—immediately revoke any wallet approvals via your wallet’s “Revoke” or “Remove Permissions” settings, then scan for malware and rotate exposed private keys or seed phrases on a clean device. Never reuse passwords or seed phrases across services, enable hardware-wallet signing when possible, and always manually type official URLs instead of clicking links. Report the domain to PhishDestroy to help protect others and accelerate its removal from blocklists.