# PhishDestroy threat dossier — onchains.my ================================================================ Fetched: 2026-07-02 15:08:23 UTC Canonical: https://phishdestroy.io/domain/onchains.my/ ## VERDICT ---------------------------------------------------------------- TAKEN DOWN (neutralised) Composite threat score: 77/100 (PhishDestroy scoring — see methodology below) Targeted brand: Ethereum ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 5/91 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Fortinet, Gridinsoft, Kaspersky, Sophos Public blocklists: listed on 3 independent blocklists ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 101.33.5.18 (NL, Amsterdam) ASN: ASAS132203 TENCENT-NET-AP-CN - Tencent Building, Kejizhongyi Avenue, CN Hosting org: AS139341 ACE Registrar: NameMart Pte. Ltd. Nameservers: ns1.domainnamens.com, ns2.domainnamens.com Registered: 2026-05-17 Expires: 2027-05-17 Page title: Ethereum HTTP response: 200 ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: TrustAsia Technologies, Inc. / TrustAsia DV TLS RSA CA 2025 Expires: 2026-08-15 Status: INVALID chain Fingerprint: dd22cc0fe1fed6c1e7da1e36583fa6344a24abd31bb1498ced25432815cd8731 Subject Alternative Names (related infrastructure — often same operator): - www.onchains.my ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: CLOSED — no report required. This domain was neutralised before the abuse-report cycle could be dispatched — either the hosting provider / registrar suspended it on their own, the DNS went dead, or the operator abandoned the infrastructure. PhishDestroy keeps the evidence bundle on file for audit but no formal notice was sent. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-05-17 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-06-29 17:20:43 UTC (by PhishDestroy tracker) First reported: 2026-06-29 15:29:45 UTC (abuse notice filed) Last verified: 2026-07-02 16:20:38 UTC Neutralised: 2026-06-29 18:17:40 UTC Current status: taken down (registrar suspended or DNS dead) ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019f13f7-1444-7739-9bd1-750988d84bd8/ URLQuery: https://urlquery.net/report/d10b2b2c-a723-457d-a0db-78215e63208d Wayback Machine: https://web.archive.org/web/*/onchains.my crt.sh CT logs: https://crt.sh/?q=%25.onchains.my Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=onchains.my AlienVault OTX: https://otx.alienvault.com/indicator/domain/onchains.my URLhaus: https://urlhaus.abuse.ch/host/onchains.my/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-06-29 17:24:53 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] This domain, onchains.my, poses a high-risk threat through brand impersonation. Specifically, it is designed to mimic the Ethereum brand, potentially misleading users into believing they are interacting with legitimate Ethereum services. This can result in the theft of sensitive information, such as login credentials or financial data, and may lead to significant financial loss or identity theft. Analysis indicates that onchains.my is currently active and was registered through NameMart Pte. Ltd. on May 17, 2026. The domain resolves to the IP address 43.152.43.121 and is protected by an SSL certificate issued by TrustAsia Technologies, Inc., which may give a false sense of security to unsuspecting users. According to VirusTotal, 2 out of 95 security vendors have flagged this domain, suggesting that while it may not yet be widely recognized as malicious, it is still a significant risk. The page title is set to 'Ethereum,' further enhancing the deception. If users have visited onchains.my, they should immediately change any passwords or login credentials used on the site. Users should also monitor their financial accounts for any unauthorized transactions and consider contacting their financial institutions if they suspect any fraudulent activity. Additionally, it is recommended that users run a full system scan using their antivirus software to ensure that no malware has been installed. It is crucial to avoid clicking on any links or downloading any files from this domain in the future. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260629-FE37EE Favicon MD5: bec772043d8b50699be707a77c19324e TLS cert SHA-256: dd22cc0fe1fed6c1e7da1e36583fa6344a24abd31bb1498ced25432815cd8731 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (operator takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/onchains.my/ JSON API: https://api.destroy.tools/v1/check?domain=onchains.my Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: independent open-source threat-intelligence platform. Tracked: 173,905 domains (14,397 alive under monitoring, 158,784 confirmed takedowns/dead). Site: https://phishdestroy.io