fantom-49750f[.]webflow[.]io

This domain, fantom-49750f.webflow.io, was identified as a high-risk brand impersonation threat targeting the Fantom cryptocurrency platform. The site replicated Fantom’s branding, including its page title and visual design, to deceive users into interacting with malicious infrastructure. No direct evidence of a crypto drainer kit was observed, but the domain’s intent aligned with credential theft or fraudulent token transfers, common in cryptocurrency-focused phishing campaigns. Analysis of technical indicators reveals the domain was created on May 8, 2013, though its malicious use likely occurred much later. It resolved to IP address 172.64.151.8, hosted on Cloudflare’s network (AS13335) in the United States. The domain was registered through MarkMonitor, Inc., a registrar often leveraged for both legitimate and malicious purposes. Google Safe Browsing flagged it as phishing, and it appeared on one security blocklist. VirusTotal reported 10 out of 95 security vendors detecting the domain as malicious, with detections spanning phishing and brand impersonation categories. The SSL certificate, issued by Google Trust Services (WE1), provided a veneer of legitimacy while failing to mitigate the underlying threat. The domain is currently offline, having been taken down following detection and blocking by security mechanisms. Despite its inactive status, residual risk persists due to the potential for re-registration or migration to a new domain under the same threat actor. Users who interacted with the site should assume credential or wallet compromise and take immediate remediation steps, including revoking active sessions, rotating passwords, and monitoring for unauthorized transactions. Organizations should update blocklists to include this domain and its associated indicators, while users are advised to verify domain authenticity before engaging with cryptocurrency platforms.