onyc[.]finance

This domain, onyc.finance, is actively engaged in cryptocurrency phishing operations designed to deploy drainer malware. Analysis indicates the site mimics legitimate decentralized finance (DeFi) platforms, likely targeting users of wallet services to execute unauthorized transactions and asset theft. No direct brand impersonation has been confirmed, but the infrastructure aligns with known crypto drainer kits observed in prior campaigns. Technical indicators reveal the domain was flagged by 2 out of 95 security vendors on VirusTotal, suggesting low initial detection but confirmed malicious intent. The domain is registered through a privacy-protected registrar, obscuring ownership details. Infrastructure analysis reveals an SSL certificate issued by Google Trust Services, a common tactic to lend false legitimacy. The domain appears on four security blocklists, including MetaMask and OISD, and resolves to an IP address with no prior malicious associations. No Google Safe Browsing (GSB) flags were recorded at the time of analysis, though this may reflect latency in GSB updates. The domain remains active, with no takedown or sinkholing observed. Current response actions include continued monitoring for shifts in infrastructure or detection rates. The elevated risk level is maintained due to the domain's direct targeting of cryptocurrency users, a high-value vector for financial theft. Organizations and individuals are advised to block the domain at the network level, update endpoint protection signatures, and conduct retrospective analysis of logs for prior connections. Users should verify transaction prompts independently and avoid interacting with unsolicited DeFi-related links.