aiblockchain-us[.]com

Analysis of aiblockchain-us.com, first observed on public blocklists in early 2026, shows a deliberately crafted wallet/seed phishing infrastructure targeting users of Blockchain.com. The domain was registered on September 22, 2025 through Gname.com Pte. Ltd. and resolves to the Cloudflare edge address 104.21.72.155, belonging to AS13335 (Cloudflare, Inc.) located in the United States. The site employed Cloudflare’s SSL certificate issued by Google Trust Services / WE1, and HTTP responses included HSTS and HTTP/3, indicating modern security headers despite the malicious intent. Technical fingerprints reveal a Node.js stack powered by Vue.js and Nuxt.js, with a LiveChat widget and Cloudflare Browser Insights embedded, suggesting the operators leveraged a generic web‑app kit to host the phishing page.

The domain is listed on two security blocklists—PhishDestroy and ScamSniffer—and appears in fourteen of ninety‑five VirusTotal scanners, reinforcing its malicious reputation. Independent trust scoring (Gridinsoft) assigned a zero out of one hundred, reflecting an extremely low trust level. Nameservers ignat.ns.cloudflare.com and zara.ns.cloudflare.com confirm the use of Cloudflare DNS. No page title was captured, so the exact content of the landing page remains unverified, but the declared scam type—wallet/seed phishing—matches the impersonation of Blockchain.com.

Defenders should block resolution of aiblockchain-us.com at network perimeter, monitor outbound connections to its Cloudflare IP, and update URL filtering rules to include the domain and its associated IP range. Endpoint security solutions should flag any credential or seed phrase submissions directed to this host. Continuous threat‑intel feeds should be consulted for any re‑activation, as the current status is offline but the infrastructure could be re‑hosted on the same CDN footprint.