onchkjghd[.]com

PhishDestroy identifies onchkjghd.com as a generic phishing domain operating as a cryptocurrency drainer kit. The site does not explicitly impersonate a well-known brand but instead employs deceptive wallet connection prompts to drain user funds. The domain serves malicious JavaScript payloads targeting blockchain users, likely leveraging fake token airdrop or wallet verification schemes to trick visitors into approving malicious transactions. This domain was flagged by only 1 out of 95 VirusTotal security vendors and is registered through Metaregistrar BV. It resolves to IP address 188.114.96.3 and was created on March 30, 2026. The infrastructure uses a Let's Encrypt SSL certificate, which may lend false legitimacy. Currently, this domain remains active and unblocked by major threat intelligence platforms including Google Safe Browsing, indicating a low early-stage detection rate. The combination of recent registration, minimal detection coverage, and active resolution suggests a rapidly evolving threat with high potential for wider exploitation. Onchkjghd.com carries an elevated risk classification on PhishDestroy, reflecting both active compromise and the plausible intent to deceive cryptocurrency users. Security researchers have not yet observed this domain on large third-party blocklists, increasing the likelihood of encounters by unsuspecting victims. Users are strongly advised to avoid visiting this domain and to validate any website using PhishDestroy’s real-time threat database. Immediate blocking at the network level via DNS or firewall rules is recommended. While the current risk is elevated, proactive monitoring and community reporting are critical to prevent broader victimization as the campaign matures.