onchainwallet[.]xin

This domain, onchainwallet.xin, is identified as a high-risk phishing resource targeting Ethereum brand assets. Analysis indicates the site employs brand impersonation techniques, presenting itself as an official Ethereum wallet interface to deceive users into disclosing private keys or transferring cryptocurrency to attacker-controlled addresses. No specific drainer kit signatures were confirmed, though the infrastructure aligns with known cryptocurrency phishing campaigns. Infrastructure analysis reveals the domain was registered on May 18, 2026, through Dominet (HK) Limited, a registrar frequently associated with malicious registrations. It resolves to the IP address 163.181.254.146, hosted by Alibaba.com LLC in Germany, a provider commonly exploited for phishing operations. The domain appears on three security blocklists, including PhishDestroy and SEAL, and is flagged by Google Safe Browsing as a phishing threat. VirusTotal detection metrics report 14 out of 95 security vendors classify the domain as malicious. The SSL certificate, issued by TrustAsia Technologies, Inc., uses the intermediate CA TrustAsia DV TLS RSA CA 2025, which does not mitigate the underlying fraudulent intent. As of the latest assessment, onchainwallet.xin has been taken offline, likely due to enforcement actions by security providers or hosting interventions. Despite its inactive status, residual risk persists for users who may have interacted with the domain prior to its removal. Organizations are advised to maintain blocklist updates and monitor for related domains registered under the same registrar or IP range. Users should verify wallet interfaces exclusively through official Ethereum channels and employ multi-factor authentication to mitigate credential theft risks.