onchaina15[.]com

The domain onchaina15.com was registered on April 17, 2026 through Gname.com Pte. Ltd. and is currently resolved to the IP address 188.114.96.3, which belongs to Cloudflare, Inc. in Canada. The authoritative nameservers are gannon.ns.cloudflare.com and khloe.ns.cloudflare.com, indicating that the domain is hosted behind Cloudflare's reverse‑proxy service. The site returns HTTP status code 200 and presents a page titled “Onchain”.

Infrastructure analysis shows that the TLS certificate is issued by Google Trust Services under the WE1 certificate authority, providing a valid chain of trust but offering no indication of the underlying content. The domain appears on three independent security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, all of which classify it as a phishing resource. Its presence on these lists aligns with the generic_phishing threat type assigned to the domain.

VirusTotal scans have flagged the domain in 2 out of 95 security vendor engines, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. AlienVault OTX reports the domain in a single threat‑intelligence pulse, further corroborating its association with phishing campaigns. Despite the low detection rate on VirusTotal, the convergence of multiple independent indicators strengthens the risk assessment.

Uncertainty remains regarding the specific payload or credential‑harvesting mechanisms employed, as no malware hashes or URLs have been publicly released. Defenders should treat onchaina15.com as a high‑risk phishing host. Recommended actions include adding the domain to inbound and outbound firewall deny lists, updating URL filtering policies, and monitoring for any authentication attempts directed at the site. Continuous observation of its DNS resolution and blocklist status is advised, as the domain remains active.