onchainwebrecovery[.]com

This domain, onchainwebrecovery.com, was registered on August 22, 2025 through Hosting Concepts B.V. d/b/a Registrar.eu and is currently active with an HTTP 200 response. The site presents the page title “Assets Recovery” and is classified as a Brand Impersonation campaign targeting the Ethereum brand. Infrastructure analysis shows the domain resolves to IP address 131.153.13.43, which belongs to AS20454 Secured Servers LLC located in the United States. The domain uses the public name servers ns1.rivaldns.com and ns2.rivaldns.com and does not present an SSL/TLS certificate, leaving traffic unencrypted. Detection data indicate that five of ninety‑five VirusTotal scanners have flagged the domain, and the domain appears on two independent security blocklists.

It is also listed as blocked by PhishDestroy and ScamSniffer. No additional threat intelligence, such as Safe Browsing or OTX entries, is available at this time. The presence on two blocklists and the specific blocklist identifiers PhishDestroy and ScamSniffer further corroborate malicious intent. The lack of TLS also facilitates network‑level observation of any data exfiltration attempts. Because the site does not provide a certificate, any credential submission would be transmitted in clear text, increasing the risk of interception.

Defenders should add the domain and its resolving IP to network blocklists, enforce TLS inspection for outbound HTTP traffic to detect unencrypted communications, and monitor for any outbound requests to the identified IP. Continuous re‑scanning with VirusTotal and inclusion in threat‑intel feeds will help capture any evolution of the campaign. Organizations that handle Ethereum‑related assets should treat any email or message referencing “Assets Recovery” from this domain as malicious and instruct users to avoid interaction.