onchainfq[.]com

This domain, onchainfq.com, is identified as a brand_impersonation threat targeting Phantom, a cryptocurrency wallet service. The domain is currently offline, though prior analysis confirms its malicious intent to deceive users into disclosing sensitive credentials or installing unauthorized software under the guise of the legitimate Phantom brand. Analysis indicates the domain was flagged by 8 of 95 security vendors on VirusTotal, with additional detections from three independent security blocklists. Infrastructure analysis reveals the domain was registered through Gname.com Pte. Ltd. on April 17, 2026, and resolved to the IP address 172.67.140.173, hosted via a content delivery network in Canada. The SSL certificate was issued by Google Trust Services (WE1), a common but not exclusive indicator of legitimacy. The page title explicitly mimicked the Phantom brand, reinforcing its fraudulent purpose. Current status confirms the domain has been taken offline, though similar threats may emerge using comparable infrastructure. Organizations and users are advised to block the domain and associated IP at perimeter defenses, monitor for recurring registrations under the same registrar, and validate SSL certificates against known legitimate issuers for Phantom. Endpoint protection should be configured to detect and prevent access to domains impersonating cryptocurrency services, particularly those with recent creation dates or low vendor detection rates.