onchaindcs[.]com

onchaindcs.com is presently classified as a high‑risk brand‑impersonation site targeting the Phantom brand. The domain resolves to the Cloudflare‑owned address 104.21.74.237 and returns HTTP 200 with the page title “Phantom”. Its SSL certificate is issued by Google Trust Services under the WE1 identifier, indicating a valid TLS termination. The domain was registered on 17 April 2026 through Gname.com Pte. Ltd. and is served by the Cloudflare authoritative nameservers max.ns.cloudflare.com and zariyah.ns.cloudflare.com. The hosting infrastructure places the IP in Canada under Cloudflare, Inc., a common front for rapid deployment of malicious payloads. The use of Cloudflare’s edge network masks the origin server, complicating direct attribution. The domain’s DNS configuration and TLS certificate are consistent with other recent impersonation campaigns that leverage reputable certificate authorities to gain user trust. Reputation signals reinforce the malicious assessment. AlienVault OTX lists the domain in a single threat‑intelligence pulse, and VirusTotal records six out of ninety‑five security vendors flagging the site as malicious. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of zero out of one hundred, reflecting a unanimous negative rating across its evaluation engine. Defenders should incorporate the domain into network‑level blocklists and monitor DNS queries for the associated Cloudflare nameservers. Given the active status and high risk rating, continuous observation of any new resolves or certificate renewals is advised. While the current evidence confirms the impersonation of Phantom, deeper analysis of the site’s content and any credential‑capture mechanisms remains pending. Organizations are recommended to educate users about unsolicited links referencing Phantom and to enforce multi‑factor authentication to mitigate potential credential compromise.