onchainqwd[.]com

The domain onchainqwd.com was registered on April 17, 2026 through Gname.com Pte. Ltd. and is currently classified as a high‑risk brand‑impersonation campaign targeting the Phantom wallet brand. The site displays a page title of "Phantom" and returns HTTP 200, indicating an active web presence designed to mimic legitimate Phantom services.

Infrastructure analysis shows the domain resolves to IP address 104.21.14.12, which belongs to Cloudflare, Inc. and is geolocated in Canada. Authoritative name servers are max.ns.cloudflare.com and zariyah.ns.cloudflare.com, both operated by Cloudflare. The TLS certificate is issued by Google Trust Services under the WE1 label, confirming a valid SSL handshake but offering no protection against the underlying malicious content.

Threat intelligence sources corroborate the malicious nature of the domain. It is listed on three security blocklists and has been blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX includes the domain in one pulse, and VirusTotal reports that 7 of 95 security vendors have flagged it as malicious. Additionally, Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high‑risk assessment.

While the exact payload or credential‑stealing mechanisms hosted on the page have not been publicly disclosed, the convergence of brand impersonation, active hosting, and multiple independent detections indicate a credible phishing operation. Defenders should block onchainqwd.com at network perimeter and endpoint filters, monitor DNS queries for the domain and its associated name servers, and update phishing detection signatures to include the observed page title and SSL issuer. Continuous telemetry collection is advised to capture any future changes in hosting or content.