onchainbasescore[.]com

On July 22, 2026, the domain onchainbasescore.com was observed as an offline site associated with a crypto‑related phishing campaign. The site was registered on September 16, 2025 through Web Commerce Communications Limited and is hosted on Cloudflare infrastructure, resolving to the IP address 104.21.64.236 belonging to AS13335 in the United States. DNS resolution uses the Cloudflare nameservers mike.ns.cloudflare.com and naya.ns.cloudflare.com, and the domain lacks an SSL certificate, indicating an unencrypted HTTP service at the time of takedown. The page title returned by the server was the German phrase “Nur einen Moment…”, and the Gridinsoft trust score assigned to the domain is 0 out of 100, reflecting a severely low reputation.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy service, confirming its classification as a malicious resource. VirusTotal analysis showed that one out of ninety‑five scanned security vendors flagged the domain, providing independent corroboration of its malicious nature. The identified scam type is a crypto scam, consistent with the broader threat landscape where attackers lure victims with promises of blockchain‑related rewards. Although the site is currently offline, the underlying infrastructure – Cloudflare hosting and the same IP address – remains reusable for future malicious deployments, so defenders should continue to monitor the IP 104.21.64.236 and the associated nameservers for reappearance.

Recommendations include adding the domain and its IP to internal blocklists, enforcing TLS inspection policies to catch any future unencrypted traffic, and updating web filtering solutions to reference the current blocklist entry. Because the site does not present an SSL certificate, any attempt to access it over HTTPS would fail, providing an additional indicator for detection.