onoplainai[.]ink

onoplainai.ink was registered through NameCheap on 24 April 2026. Within three months of its creation the domain has been flagged by 18 of 91 security vendors on VirusTotal, indicating a consensus among scanning engines that the site hosts malicious content. It appears on a single public blocklist and is actively blocked by the PhishDestroy filtering service, which classifies it as a generic phishing resource.

The elevated risk rating reflects the combination of rapid detection adoption and the presence of the domain on a reputable anti‑phishing feed. No additional infrastructure details such as hosting IP, ASN, or SSL certificate information are currently available in public sources, and the page title or any brand‑specific lure has not been disclosed. Consequently, the precise phishing campaign vector and targeted victims remain uncertain.

Analysts should treat the domain as hostile and incorporate it into perimeter defenses. Recommended actions include adding the domain to DNS‑based blocklists, configuring web proxies to deny HTTP/HTTPS requests to the host, and enabling endpoint URL filtering to trigger alerts on any attempted connections. Continuous monitoring of threat‑intel feeds for new detections, as well as periodic re‑scanning on VirusTotal, will help determine whether the domain’s activity expands or if additional indicators such as IP addresses or payload samples emerge.