onchain6[.]in

The domain onchain6.in is a phishing site engaged in brand impersonation targeting Ethereum users. It presents itself as a legitimate Ethereum-related platform under the false pretense of 'Onchain-ETH 2.0,' aiming to deceive victims into disclosing sensitive information or interacting with malicious smart contracts. No crypto drainer kit was identified, but the site poses an elevated risk due to its impersonation of a major blockchain brand. As of the latest verification, onchain6.in has been taken offline.

Technical indicators confirm the malicious nature of onchain6.in. The domain was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). Registered through Dynadot LLC on February 09, 2025, it resolves to the IP address 172.67.200.201, hosted on Cloudflare's infrastructure (AS13335) in the US. The SSL certificate was issued by Let's Encrypt (R12), and the site was observed using PHP and Apache HTTP Server. Google Safe Browsing has not flagged the domain, and Gridinsoft assigned it a trust score of 0/100.

Users who interacted with onchain6.in should immediately revoke any token approvals granted to unknown contracts and consider transferring funds to a new wallet. If credentials were entered, change passwords for all associated accounts and enable two-factor authentication. Report the phishing domain to platforms such as Google Safe Browsing, PhishTank, or the impersonated brand's security team (Ethereum) to aid in takedown efforts. Monitor accounts for unauthorized transactions or suspicious activity.