# onchecks.xyz — MALICIOUS

> Stay safe from phishing on onchecks.xyz, a fake Lighter airdrop checker site. Avoid sharing personal info and report suspicious activity immediately.

## Summary
PhishDestroy identifies onchecks.xyz as an active medium-risk phishing domain impersonating a cryptocurrency airdrop checker branded "Lighter." This fraudulent site aims to deceive users into divulging sensitive information by mimicking legitimate airdrop verification services, often used within crypto communities.

The domain onchecks.xyz was registered recently on February 21, 2026, and resolves to IP address 172.67.195.163. It currently appears on one security blocklist and has been flagged by 5 out of 95 antivirus engines in VirusTotal scans, indicating moderate suspicion across multiple detection platforms. The domain’s page title "Lighter | Airdrop Checker" attempts to lend credibility to the phishing lure.

As of now, onchecks.xyz remains active and continues to pose a threat to users seeking cryptocurrency airdrop verification. PhishDestroy recommends users avoid interacting with this domain, refrain from submitting any personal or wallet data, and report the site to their security teams. Employing updated endpoint security and browser filters can further mitigate exposure to this phishing attempt.

## Threat Details
- Verdict: MALICIOUS
- Site status: alive (HTTP 530)
- Page title: Lighter | Airdrop Checker

## Domain Intelligence
- Registered: 2026-02-21 07:01:08
- IP: 172.67.195.163
- SSL Issuer: WE1

## Detection Status
- VirusTotal: 5 vendors flagged
  Vendors: ["CyRadar", "Forcepoint ThreatSeeker", "Fortinet", "Gridinsoft", "SOCRadar"]
- Google Safe Browsing: clean
- Blocklists: 1 hits
  Lists: ["PhishDestroy"]

## Evidence
- Screenshot: https://urlscan.io/screenshots/019b2e98-2697-70a1-8082-dcaafeeaa83b.png
- PhishDestroy: https://phishdestroy.io/domain/onchecks.xyz/
- LLM endpoint: https://phishdestroy.io/domain/onchecks.xyz/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/onchecks.xyz/
Last updated: 2026-03-19