onekey[.]gr[.]com

This domain is flagged as a crypto wallet phishing site designed to harvest sensitive credentials, including private keys and recovery phrases. Analysis indicates an elevated risk level due to its targeted threat vector, which specifically aims to compromise digital asset storage solutions. The domain operates under the guise of a legitimate wallet service, increasing the likelihood of successful social engineering attacks against cryptocurrency users. Infrastructure analysis reveals the domain onekey.gr.com was registered through Key-Systems GmbH and resolves to the IP address 191.44.114.185. It is currently offline but was previously detected by 4 out of 95 security vendors on VirusTotal, with three distinct security blocklists listing it as malicious. The site employed a Let's Encrypt SSL certificate to mimic secure connections, while its page title, www.www.onekey.gr.com, suggests poor operational security or deliberate obfuscation. Gridinsoft assigned a trust score of 0/100, further confirming its malicious nature. Technologies detected include Nginx, a common web server used in both legitimate and malicious deployments. Mitigation against this specific threat type requires immediate action from both end-users and network administrators. Users who may have interacted with the domain should assume their wallet credentials are compromised and transfer assets to a new, secure wallet using a clean device. Multi-factor authentication should be enabled on all cryptocurrency-related accounts, and hardware wallets should be used for storing private keys offline. Network-level protections include blocking the IP address 191.44.114.185 and implementing real-time domain reputation checks to prevent access to newly registered or low-trust domains. Security teams should monitor for outbound connections to the resolved IP and investigate any prior interactions with the domain, particularly from systems used for cryptocurrency transactions.