onchain-resolve[.]xyz

On 23 July 2026, the domain onchain-resolve.xyz was observed hosting a phishing page whose HTML title resolves to “Just a moment…”. The site was registered on 21 February 2026 through NiceNIC International Group Co., Limited and is served from the Cloudflare edge address 188.114.97.3, which belongs to AS13335 (Cloudflare, Inc.) in the United States. No TLS certificate was presented, indicating the site operated over plain HTTP. The domain is listed on a single security blocklist and has been flagged by PhishDestroy as offline.

VirusTotal scans show that five of ninety‑three AV engines flagged the domain, confirming malicious intent despite the limited detection coverage. The nameservers dee.ns.cloudflare.com and trace.ns.cloudflare.com are standard Cloudflare authoritative servers, providing no additional attribution. The only publicly disclosed classification is “Crypto Scam”, suggesting the page was intended to lure victims into cryptocurrency‑related credential theft or fund transfers. At the time of analysis the site returned a generic title page and no further content was captured, leaving the exact phishing vector, target brand, or credential collection mechanism unknown.

Defenders should continue to block the domain at perimeter and DNS layers, monitor for any resurgence of the host under the same IP range, and add the IP address 188.114.97.3 to threat‑intel feeds. Because the infrastructure relies on Cloudflare, any future re‑hosting could inherit the same edge IPs, so regular re‑resolution of the domain is advised. Organizations handling cryptocurrency assets should treat any unsolicited communications referencing “onchain-resolve” as malicious and educate users to avoid entering private keys or seed phrases on unknown sites.