governance-onyx[.]xyz

This domain is flagged as an elevated-risk crypto drainer phishing site targeting cryptocurrency wallet credentials and funds. Analysis indicates the infrastructure was designed to deceive users into connecting wallets to malicious smart contracts, enabling unauthorized token transfers. The domain was operational until recently, with active blocking by multiple security entities confirming its malicious intent. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 26, 2026, an unusual creation date suggesting potential domain spoofing or typo-squatting. It resolved to IP address 104.21.71.224, leveraging Cloudflare services and HTTP/3 protocol, likely to obfuscate backend infrastructure and evade detection. The domain appears on three security blocklists, with six out of ninety-five security vendors on VirusTotal flagging it as malicious. Additional trust scoring systems assigned a 0/100 trust rating, reinforcing its high-risk classification. The page title 'Just a moment...' is consistent with intermediate loading pages used to mask phishing content or redirect users to fraudulent interfaces. Mitigation requires immediate action from both end users and network administrators. Users who interacted with this domain should revoke any wallet connections made during the suspected timeframe and transfer assets to a new, secure wallet. Network-level protections should include blocking the domain and its associated IP (104.21.71.224) at the firewall or DNS resolver level. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP range, as these may indicate coordinated phishing campaigns. Security teams are advised to review logs for connections to this domain or its IP, particularly from systems handling cryptocurrency transactions, and to implement multi-factor authentication for all wallet access.