onchainearntide[.]com

This domain, onchainearntide.com, is identified as a brand impersonation threat targeting Ethereum, a major blockchain platform. Analysis indicates the domain was designed to deceive users into believing they are interacting with legitimate Ethereum services, likely for credential harvesting or cryptocurrency theft. The page title, NGINX Open Source packaged by Bitnami, suggests the use of a standardized web server configuration, which is often leveraged in phishing campaigns to mimic legitimate infrastructure.

Infrastructure analysis reveals the domain was registered on August 12, 2025, through Gname.com Pte. Ltd. It resolves to the IP address 172.67.170.92, hosted on Cloudflare's network (AS13335). The SSL certificate is issued by Google Trust Services (WE1), a common practice among malicious actors to evade basic security warnings. The domain appears on 2 security blocklists and is flagged by 13 out of 95 security vendors on VirusTotal. Additionally, it has been blocked by at least two specialized threat intelligence platforms, indicating prior detection and mitigation efforts.

As of the latest assessment, onchainearntide.com has been taken offline, reducing immediate risk to users. However, the infrastructure remains a potential vector for future attacks, particularly if the threat actors reuse the domain registration or hosting patterns. Organizations and users are advised to monitor for similar domains leveraging Ethereum branding, particularly those registered through the same registrar or resolving to Cloudflare IPs. Blocking the domain and associated IP at the network level is recommended to prevent accidental exposure. Continuous vigilance is required, as threat actors frequently rotate domains and IPs to evade detection.