h5[.]onchianapp[.]cc

This domain, h5.onchianapp.cc, is classified as a high-risk cryptocurrency phishing resource. Analysis indicates it is actively employed in campaigns designed to harvest wallet credentials, private keys, or seed phrases through fraudulent decentralized application (dApp) interfaces. The threat type is narrowly defined as cryptocurrency-specific phishing, distinguishing it from generic credential theft schemes. Infrastructure analysis reveals multiple indicators of malicious intent. The domain resolves to IP address 45.192.98.58, hosted under AS401701 (cognetcloud INC) in Hong Kong. It is registered through Spaceship, Inc., with an anomalous creation date of May 25, 2026, suggesting domain spoofing or registry manipulation. Security vendor detections on VirusTotal report 8/95 flags, while the domain appears on three independent blocklists, including sector-specific cryptocurrency threat feeds. The SSL certificate, issued by Let's Encrypt (R13), provides baseline encryption but does not mitigate the underlying phishing risk. The page title, DEV_TITLE, further suggests an incomplete or template-based deployment typical of phishing kits. Mitigation requires immediate action from both end users and network administrators. Users should verify all cryptocurrency-related domains against known legitimate URLs and avoid interacting with unsolicited wallet connection prompts. Browser-based wallet extensions should block access to this domain via preconfigured blocklists. Network-level protections should include DNS filtering to prevent resolution of h5.onchianapp.cc and its associated IP. Given the domain's active status and targeted nature, organizations handling cryptocurrency transactions should treat this resource as a critical threat vector and prioritize its inclusion in security awareness training.