onc188[.]vip

The domain onc188.vip has been identified as a crypto drainer phishing site, currently taken offline after being flagged for malicious activity. This domain was designed to impersonate decentralized finance (DeFi) platforms, as indicated by its page title 'defi-ETH', likely aiming to steal cryptocurrency wallet credentials or trick users into signing fraudulent transactions. The domain was registered on December 30, 2024, through Gname.com Pte. Ltd., a registrar often associated with low-cost or suspicious domains, and resolves to IP address 104.21.96.1. Notably, it lacks an SSL certificate, a red flag for any site handling sensitive data.

According to threat intelligence data, onc188.vip was flagged by 4 out of 95 security vendors on VirusTotal, indicating moderate but concerning detection rates. It also appears on one security blocklist and was found in one threat intelligence pulse on AlienVault OTX, suggesting active monitoring by the security community. The domain's recent creation date and lack of legitimate content further support its malicious intent. While currently offline, the domain could be reactivated or redirected to new phishing pages, as is common with such campaigns.

PhishDestroy recommends that users avoid any interaction with onc188.vip or similar domains. If you have visited this site, do not enter any personal information, connect your crypto wallet, or approve any transactions. For ongoing protection, use PhishDestroy to verify the legitimacy of DeFi platforms and report any suspicious domains to help keep the community safe. Always double-check URLs and ensure sites use HTTPS before engaging with financial services.