onchainrectification[.]app

This domain, onchainrectification.app, is flagged as a crypto drainer phishing site designed to harvest wallet credentials and drain cryptocurrency assets. Analysis indicates no direct brand impersonation, but the domain name suggests a focus on blockchain or DeFi users, likely leveraging social engineering tactics to trick victims into connecting wallets to malicious smart contracts. The absence of a known drainer kit fingerprint does not preclude custom or obfuscated payloads, which may evade static detection. Infrastructure analysis reveals the following technical indicators: the domain was registered on February 21, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other phishing campaigns in recent months. VirusTotal detection shows 3 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist, and its page title, 'Just a moment...', is consistent with cloaking techniques used to evade automated scanners. Google Safe Browsing (GSB) status is not explicitly provided, but the elevated risk level suggests it may be under review or partially blocked. Current status remains active, with no evidence of takedown or sinkholing. Response actions should include immediate blocking of the domain and IP at the network perimeter, as well as monitoring for outbound connections to 188.114.96.3. Users who may have interacted with the domain should revoke wallet permissions, rotate credentials, and scan for unauthorized transactions. The remaining risk is elevated due to the domain's recent registration, low detection rate, and potential for custom payloads. Organizations are advised to treat this domain as a high-priority threat and prioritize endpoint and network-level protections.