onchain-sadas[.]com

This domain, onchain-sadas.com, is flagged for high-risk brand impersonation targeting Phantom, a cryptocurrency wallet provider. Analysis indicates the site presents a fraudulent interface designed to harvest user credentials and private keys, likely deploying a cryptocurrency drainer kit to siphon digital assets from victims. The page title explicitly replicates Phantom’s branding, increasing the likelihood of successful deception. Infrastructure analysis reveals the domain was registered on October 18, 2025, through Gname.com Pte. Ltd. It resolves to IP address 172.67.211.210, hosted on Cloudflare’s network (AS13335). VirusTotal detection shows 12 out of 95 security vendors have flagged the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of legitimacy. No Google Safe Browsing (GSB) detection is currently recorded. The domain remains active as of this report, though it has been blocked by multiple security entities. Despite these countermeasures, the infrastructure persists, posing an ongoing risk to users who may encounter it through phishing campaigns or malicious advertisements. Recommendations include immediate blacklisting of the domain and IP, monitoring for associated wallet addresses, and user education on verifying legitimate Phantom domains before entering sensitive information.