h5[.]onchainusdm[.]com

This domain, h5.onchainusdm.com, is flagged as a high-risk crypto drainer phishing site designed to compromise digital asset wallets through deceptive on-chain transaction interfaces. Analysis indicates the domain specifically targets users engaging with blockchain-based financial activities, likely exploiting familiarity with legitimate transaction platforms to execute unauthorized fund transfers. Infrastructure analysis reveals the domain was registered on February 07, 2026, through Cloudflare, Inc., and currently resolves to IP address 172.67.185.8 (AS13335, Cloudflare, Inc., US). The SSL certificate is issued by Google Trust Services (WE1), a common practice among phishing sites to appear legitimate. Security vendor detection stands at 2/95 on VirusTotal, while the domain appears on three distinct security blocklists, including PhishDestroy, MetaMask, and SEAL. The page title, 'On-chain Transactions,' aligns with the domain's deceptive theme, further suggesting an intent to mimic authentic cryptocurrency transaction portals. Mitigation requires immediate action from both end users and security teams. Users should avoid interacting with the domain, particularly any prompts to connect wallets or authorize transactions. Wallet software should be configured to reject connection requests from untrusted domains, and browser-based wallet extensions should be set to enforce strict domain allowlisting. Network-level blocking of the domain and its resolving IP (172.67.185.8) is recommended for enterprise environments. Given the domain's active status and high-risk classification, monitoring for similar patterns—such as newly registered domains with cryptocurrency-related keywords and Cloudflare-hosted infrastructure—should be prioritized in threat detection workflows.