crypto-onchain[.]co

This domain, crypto-onchain.co, operates as a crypto drainer phishing site designed to harvest wallet credentials and drain cryptocurrency assets from unsuspecting users. The site impersonates legitimate blockchain services under the guise of "Crypto Onchain," leveraging social engineering tactics to trick victims into entering private keys or seed phrases. Infrastructure analysis reveals the use of Cloudflare hosting and HTTP/3 protocols, which may obscure malicious activity behind legitimate CDN services. The page title "Crypto Onchain" and the absence of substantive content further indicate an intent to deceive users into interacting with fraudulent wallet interfaces or transaction prompts. Evidence of malicious activity is substantiated by multiple technical indicators. The domain was registered on June 29, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with phishing campaigns. VirusTotal detection metrics show 12 out of 95 security vendors flagging the domain as malicious, while it appears on three independent security blocklists. The domain resolves to the IP address 104.21.73.239, a Cloudflare-associated IP range commonly exploited for phishing infrastructure. Google Safe Browsing has classified the site under the "SOCIAL_ENGINEERING" category, confirming its use in deceptive practices. Additionally, the domain has been blocked by wallet security extensions and phishing detection tools, further validating its role in credential theft operations. Users who have visited crypto-onchain.co or interacted with its content should take immediate remedial actions. Any credentials, private keys, or seed phrases entered on the site must be considered compromised and should be revoked or transferred to a new, secure wallet. Affected users should audit all recent transactions for unauthorized activity and enable multi-factor authentication on all cryptocurrency accounts. System scans using updated security tools are recommended to detect potential malware or backdoors installed during the interaction. Future vigilance is advised, particularly when engaging with domains registered through high-risk registrars or those exhibiting recent creation dates and low trust scores, such as the 0/100 rating assigned by Gridinsoft.