onchain-crypto-zx[.]cc

PhishDestroy identifies onchain-crypto-zx.cc as an active cryptocurrency drainer impersonating legitimate blockchain services. This domain leverages deceptive naming to trick users into connecting crypto wallets, enabling unauthorized fund transfers. The campaign poses a high risk to cryptocurrency holders due to its stealthy execution and minimal initial detection coverage. This domain was flagged with a threat type of generic_phishing and is classified as an active cryptocurrency drainer. The domain resolves to IP 104.21.56.138, registered through Gname.com Pte. Ltd., and utilizes a Let's Encrypt SSL certificate. Domain creation occurred on April 16, 2026, and it currently shows 2/95 detections on VirusTotal, with no blocklist entries as of the latest investigation. The domain's recent registration and lack of detection suggest it is part of an emerging threat campaign targeting crypto users. Mitigation steps for this cryptocurrency drainer threat include immediately blocking the domain and associated IP address (104.21.56.138) at the network and DNS levels. Users should avoid interacting with this domain or any linked websites, and verify the authenticity of crypto-related platforms through official channels. Cryptocurrency holders are advised to revoke any unauthorized wallet connections and monitor transactions closely. Organizations should update threat intelligence feeds and firewalls to include this domain, and consider deploying web filtering rules to prevent access. Additionally, reporting this domain to relevant authorities and threat intelligence platforms can aid in broader detection and takedown efforts.