onionpages[.]com

PhishDestroy identifies onionpages.com as a live crypto-drainer phishing domain deployed under the generic threat label. No specific brand impersonation is confirmed in open intelligence, but the site’s technical footprint suggests a web3-targeting drainer kit is actively hosted. The domain leverages a Let’s Encrypt SSL certificate to appear legitimate and relies on a simple, recently registered name to evade long-term detection. Investigators have yet to extract the drainer’s payload or wallet addresses, so the exact kit remains unclassified. This domain resolves to IP 213.111.146.253 and was created on 2025-08-27 through TUCOWS.COM, CO. VirusTotal currently scores it 1/95 detections, indicating zero antivirus coverage as of the last scan. Google Safe Browsing has not yet flagged the page, and the domain has not appeared on any public blocklists, leaving a clean slate for threat actors to operate. The absence of detections correlates with the domain’s youth, but the combination of a fresh registration, unlisted IP, and zero VT coverage creates a high-risk hosting environment. onionpages.com remains in active status with the risk level marked “under_investigation,” meaning defensive actions are still pending. Security teams should treat the domain as hostile until payload extraction or brand impersonation is confirmed. Users encountering the site should not interact and instead verify its safety on PhishDestroy before proceeding. The current risk is elevated due to the domain’s unblocked, newly active state and the likelihood of drainer code being served to unsuspecting visitors.