onchaindfew[.]com

onchaindfew.com was registered on April 17, 2026 and is hosted behind Cloudflare's network (IP 104.21.22.186, located in Canada). The domain resolves to the same IP used by multiple malicious sites and presents a valid SSL certificate issued by Google Trust Services under the WE1 root. DNS queries return the Cloudflare authoritative name servers max.ns.cloudflare.com and zariyah.ns.cloudflare.com. An HTTP GET returns status 200 and the page title is exactly “Phantom”, matching the targeted brand.

The site is a classic brand‑impersonation page that mimics the official Phantom wallet interface. VirusTotal scans flagged the domain on 7 of 95 engines, and Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. The domain appears on three independent blocklists and has been proactively blocked by PhishDestroy, MetaMask, and SEAL. AlienVault OTX references the domain in one threat‑intel pulse, confirming its use in active campaigns.

Registration details show the domain was purchased through Gname.com Pte. Ltd., a registrar often associated with throwaway registrations. No additional infrastructure such as dedicated hosting or unique IP ranges is observed; the site relies on Cloudflare's shared edge service, which obscures the true backend server. The combination of recent creation, brand‑matching page title, low trust score, and multiple blocklist listings points to a coordinated impersonation effort launched in the current quarter.

Defenders should immediately add onchaindfew.com to deny‑list rules across DNS, web‑proxy, and endpoint protection solutions. Continuous monitoring of newly created domains that resolve to Cloudflare IPs and use the “Phantom” page title is advised, as similar patterns have been observed in recent campaigns. Updating threat‑intel feeds with the domain and its associated identifiers (nameservers, IP, registration registrar) will help prevent downstream infection attempts.