onchain-dex[.]top

This domain onchain-dex.top is flagged as an active brand impersonation threat targeting Ethereum. Registered on December 28, 2025 through NameSilo, LLC, the domain remains active and resolves to IP address 118.107.59.199. Security analysis shows 15 out of 95 security vendors on VirusTotal flag this domain as malicious, indicating a consensus among detection engines that it is associated with phishing activity. The page title observed is 'Trust', which aligns with common phishing tactics that use trust-related branding to deceive users. The domain is secured with a Let's Encrypt SSL certificate, which is a standard free certificate provider and does not imply legitimacy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the high-risk classification. AlienVault OTX reports this domain appears in 24 separate threat intelligence pulses, demonstrating widespread recognition among security researchers and threat intelligence feeds. The domain is blocked by PhishDestroy and BLP-Malware, and it appears on two security blocklists. Defenders should treat this domain as a confirmed phishing site that impersonates the Ethereum brand. All traffic to onchain-dex.top should be blocked, and users who may have visited the domain should be instructed not to enter any credentials, private keys, or personal information. The IP address 118.107.59.199 associated with this domain should also be monitored or blocked at the network perimeter. Further investigation into the hosting provider and any additional domains sharing this infrastructure may help identify broader phishing operations.