onchain-sdq[.]com

This domain, onchain-sdq.com, is actively flagged as a high-risk brand impersonation site targeting Phantom, a cryptocurrency wallet service. Registered on April 17, 2026, through Gname.com Pte. Ltd., the domain resolves to 104.21.49.222, a Cloudflare-hosted IP located in Canada. Analysis of infrastructure reveals Cloudflare nameservers (braelyn.ns.cloudflare.com, jermaine.ns.cloudflare.com) and a Google Trust Services SSL certificate (WE1), which are common among both legitimate and malicious sites but do not mitigate the threat in this case. The page title explicitly displays 'Phantom,' aligning with the reported impersonation of the Phantom wallet brand. Security vendors have flagged the domain on three blocklists, including PhishDestroy, MetaMask, and SEAL, and it appears in one AlienVault OTX threat intelligence pulse. Five of 94 security vendors on VirusTotal detect the domain as malicious, though this partial detection rate suggests variability in vendor coverage rather than definitive classification. The domain remains operational, returning an HTTP 200 status as of July 12, 2026. Defenders should treat this domain as confirmed malicious infrastructure and prioritize blocking it at the DNS, IP, and certificate levels. Given the targeting of cryptocurrency users, additional monitoring for wallet-draining activity or credential harvesting associated with this domain is recommended. The exact content and functionality of the site have not been analyzed, but the combination of brand impersonation, active blocklist presence, and cryptocurrency targeting warrants immediate mitigation.