onchaivd[.]com

Analysis of the domain onchaivd.com indicates active brand impersonation targeting Phantom, a cryptocurrency wallet service. The domain was registered on April 17, 2026, through Gname.com Pte. Ltd. and currently resolves to the IP address 188.114.97.3, which is geolocated to Canada and associated with Cloudflare, Inc. infrastructure. The domain is served by Cloudflare nameservers (max.ns.cloudflare.com and zariyah.ns.cloudflare.com) and presents an SSL certificate issued by Google Trust Services (WE1), a common configuration for both legitimate and malicious sites leveraging Cloudflare services. The domain is flagged on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, suggesting confirmed malicious activity. As of July 12, 2026, the domain remains active with an HTTP 200 status, and its page title is identified as 'Phantom,' reinforcing the brand impersonation classification. VirusTotal reports that 3 of 94 security vendors detect the domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain has also been referenced in one threat intelligence pulse on AlienVault OTX, further corroborating its association with phishing campaigns. Infrastructure analysis reveals no evidence of a custom phishing kit or unique attack vector at this time, though the use of Cloudflare may obscure deeper technical indicators. Defenders should prioritize blocking the domain and its resolving IP (188.114.97.3) at the network level, particularly in environments where Phantom wallet services are utilized. Given the domain's recent registration and continued activity, monitoring for related domains registered through the same registrar (Gname.com Pte. Ltd.) or resolving to the same IP may aid in identifying additional threats. The exact content and functionality of the site remain unanalyzed, but the available evidence confirms its role in a high-risk brand impersonation campaign.