reward-onyx[.]xyz

The domain reward-onyx.xyz has been identified as an active phishing infrastructure designed for brand impersonation targeting Ledger, a cryptocurrency hardware wallet provider. Analysis indicates this resource is currently operational and classified as high-risk due to its deceptive intent to mimic legitimate Ledger services. The page title, 'Onyx - XCN Ledger Blockchain,' further suggests an attempt to exploit trust in blockchain-related platforms, potentially luring victims into disclosing sensitive credentials or transferring digital assets under false pretenses. Technical indicators reveal the domain was registered on June 15, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious registrations. It resolves to the IP address 188.114.96.3, which has been flagged by 5 of 95 security vendors on VirusTotal for hosting phishing content. The domain appears on three distinct security blocklists, including those maintained by cryptocurrency security frameworks and anti-fraud systems. The SSL certificate is issued by Google Trust Services (WE1), which, while not inherently malicious, is often leveraged by threat actors to lend a false sense of legitimacy to fraudulent sites. Current status confirms the domain remains active and poses a significant risk to users unfamiliar with Ledger’s official communication channels. Organizations and individuals are advised to block resolution to 188.114.96.3 at the network level and update endpoint protection rules to include reward-onyx.xyz in denylists. Users should verify all communications claiming to originate from Ledger by cross-referencing with the official domain and refrain from entering credentials or wallet information on untrusted platforms. Monitoring for additional domains registered under the same registrar or resolving to the same IP may help preempt further campaigns.