on-chainku[.]com

This domain, on-chainku.com, is flagged as a cryptocurrency phishing site targeting wallet credentials and private keys. Analysis indicates no direct association with known drainer kits or branded impersonation, though the infrastructure aligns with generic phishing campaigns observed in the cryptocurrency ecosystem. The domain was likely designed to mimic legitimate blockchain services or decentralized applications to deceive users into disclosing sensitive information. Infrastructure analysis reveals the following technical indicators: the domain resolves to IPv6 address 2606:4700:3036::6815:19be and was registered on October 20, 2025, through Gname.com Pte. Ltd. As of the latest assessment, VirusTotal reports 0 detections out of 95 engines, while Gridinsoft assigns a trust score of 0/100. The domain appears on 3 security blocklists and is currently blocked by MetaMask, SEAL, and PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. The domain is currently offline, displaying a seizure notice with the page title 'This Website Has Been Seized.' This status may indicate law enforcement action or voluntary takedown by the registrar. Despite its offline state, residual risk remains due to potential reuse of the infrastructure or re-registration under a different name. Organizations are advised to maintain blocklist entries for this domain and monitor associated IP addresses for further malicious activity. Users should verify wallet addresses and avoid interacting with domains flagged for cryptocurrency-related phishing.