onchain[.]org[.]im

This domain, onchain.org.im, is identified as a high-risk cryptocurrency phishing site designed to impersonate legitimate exchange infrastructure. Analysis indicates the site specifically targets users of the FTX platform, as suggested by the page title 'swyFtx,' which mimics FTX branding. No direct evidence of a drainer kit was observed, but the presence of Node.js and UmiJs frameworks suggests a custom-built credential harvesting mechanism. The domain exhibits characteristics consistent with phishing campaigns aimed at cryptocurrency users, including the use of Let's Encrypt SSL certificates to appear legitimate. Technical indicators confirm the malicious nature of this domain. It resolves to the IP address 43.130.156.234, registered on March 29, 2026, through an undisclosed registrar. Google Safe Browsing flags the domain under the 'SOCIAL_ENGINEERING' category, and 17 out of 95 security vendors on VirusTotal detect it as malicious. The domain appears on three security blocklists, including those maintained by cryptocurrency security entities. Detected technologies include Nginx as a reverse proxy, jQuery for frontend interactivity, and HTTP Strict Transport Security (HSTS) to enforce encrypted connections, further obfuscating its malicious intent. As of the latest assessment, onchain.org.im has been taken offline, likely in response to its inclusion on multiple blocklists and threat intelligence feeds. However, the infrastructure remains a residual risk, as the domain and associated IP may be reactivated or repurposed for future campaigns. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and monitor for unauthorized transactions. Organizations are advised to block the domain, IP, and associated SSL certificate fingerprints in network security controls to prevent potential re-emergence.