decentralizedonchain[.]com

Analysis of decentralizedonchain.com indicates an active high-risk phishing domain targeting decentralized finance (DeFi) users. The domain, registered on June 12, 2025, through GMO Internet Group, Inc. d/b/a Onamae.com, resolves to IP address 15.197.240.20 and is hosted on infrastructure running Nginx and OpenResty. The page title, 'Defi Dapp Pages – Fast Wallet Resolver,' suggests an attempt to mimic legitimate wallet resolution or DeFi dApp services, though the exact content and functionality remain unconfirmed as the site has not been directly analyzed. The domain is flagged by 9 of 95 security vendors on VirusTotal and appears on five security blocklists, including Polkadot, Codeesura, PhishDestroy, Enkrypt, and BLP-Malware. AlienVault OTX records the domain in 25 threat intelligence pulses, further indicating malicious intent. Scamadviser and Gridinsoft both assign the lowest possible trust scores (1/100 and 0/100, respectively), reinforcing its classification as a high-risk threat. Defenders should treat this domain as an active phishing resource. Block DNS resolution to 15.197.240.20 and monitor for connections to decentralizedonchain.com in proxy, firewall, and endpoint logs. Given the domain's focus on DeFi and wallet-related services, prioritize alerts involving cryptocurrency wallet applications, browser extensions, or users accessing decentralized finance platforms. No evidence currently links this domain to a specific phishing kit or campaign, so additional context from endpoint or network telemetry may be required for deeper attribution.