onlylinks[.]cc

This domain, onlylinks.cc, is identified as a generic phishing site with an elevated risk level. Analysis indicates it was designed to harvest cryptocurrency wallet credentials, likely through cloned login portals or deceptive transaction prompts. No specific brand impersonation or drainer kit signatures were confirmed in initial triage, though the domain's infrastructure aligns with common phishing campaign patterns targeting decentralized finance (DeFi) users. The site's maintenance page title suggests an attempt to mask malicious activity or evade detection during inactive phases. Infrastructure analysis reveals the domain was registered on January 2, 2025, through NAMECHEAP INC, a registrar frequently associated with low-cost, short-lived malicious domains. It resolves to the IP address 99.83.206.25, hosted under AS13335 (Cloudflare, Inc.), a network often leveraged to obfuscate origin servers. At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged onlylinks.cc as malicious, while it appeared on one additional security blocklist. Google Safe Browsing (GSB) status was not explicitly provided, but the domain's offline status and prior detections suggest it was previously active in phishing operations. The domain is currently offline, likely due to takedown actions or voluntary suspension by the registrar. It was blocked by at least one security entity, reducing immediate exposure risks. However, residual threats persist, as associated infrastructure (e.g., IP, registrar) may be reused for future campaigns. Users who interacted with the domain should revoke any connected wallet permissions, monitor for unauthorized transactions, and verify device integrity. Organizations are advised to proactively block the domain and IP in perimeter defenses, while security teams should investigate potential correlations with other phishing domains registered through the same registrar or hosted on the identified IP range.