y-onchain[.]com

Analysis of y-onchain.com indicates that the domain was registered on 21 February 2026 and is currently taken offline. DNS resolution points to the address 104.21.64.1, which belongs to Cloudflare, Inc. (AS13335) located in the United States. The site is listed on two public security blocklists and is actively blocked by PhishDestroy and ScamSniffer, confirming its malicious reputation. VirusTotal reflects that 15 of 93 scanned security engines flagged the domain, reinforcing the suspicion of abuse. AlienVault OTX includes the domain in one threat‑intelligence pulse, providing additional community corroboration.

The presented SSL certificate is identified as “WE1”, but no further certificate details are available. No page‑title or brand information has been disclosed, and the HTTP response status is not recorded, leaving the exact content of the site unknown. Because the site is offline, a direct payload analysis was not possible; therefore the precise phishing vector and targeted credentials remain undetermined. Threat actors may be leveraging the domain to impersonate blockchain or cryptocurrency services, suggested by the name, but no concrete evidence of the lure has been observed.

The combination of recent registration, Cloudflare hosting, multiple vendor detections, and blocklist listings supports an elevated risk assessment. Defenders should add 104.21.64.1 to deny‑list rules, enforce DNS filtering for y‑onchain.com, and monitor for any re‑appearance of the domain or similar aliases. Continuous re‑scanning on VirusTotal and periodic review of OTX pulses are recommended to capture potential changes in the threat posture. Until further content is captured, security teams should treat any traffic to the domain as hostile and consider broader protection measures such as URL filtering and endpoint heuristics to detect potential credential‑stealing attempts.