onchain-sqwe[.]cc

The domain onchain-sqwe.cc was registered on 17 April 2026 through Gname.com Pte. Ltd. and is hosted behind Cloudflare’s network (IP 104.21.48.52, located in Canada). DNS resolution uses the Cloudflare nameservers braelyn.ns.cloudflare.com and jermaine.ns.cloudflare.com. The site serves HTTP 200 responses and presents a TLS certificate issued by Google Trust Services under the WE1 root, indicating a valid HTTPS endpoint.

VirusTotal scans have flagged the domain by six of ninety‑five security vendors, and the host appears on three public blocklists. It is also listed in one AlienVault OTX pulse and has been actively blocked by PhishDestroy, MetaMask, and SEAL. The page title returned by the server is “Phantom”, matching the targeted brand, and the site is classified as a brand‑impersonation campaign aimed at Phantom users.

Current intelligence confirms the domain’s active status and its use of legitimate‑looking TLS, which may increase user trust. However, the specific payload or credential‑harvesting mechanisms employed on the page have not been publicly disclosed, and no malware hashes have been associated with the site. The limited detection footprint (six vendor flags) suggests that the campaign may be in an early deployment stage or employing evasion techniques to avoid broader detection.

Defenders should immediately add onchain-sqwe.cc to URL filtering and DNS block lists, enforce HTTPS inspection to detect any credential submission, and monitor for similar domains registered through the same registrar or using the same Cloudflare nameservers. Continuous re‑scanning with VirusTotal and correlation with threat‑intel feeds will help capture any evolution of the campaign, and incident response teams should be prepared to advise users of Phantom to verify URLs before entering wallet credentials.