onchainusdt[.]cc

This domain, onchainusdt.cc, is identified as a high-risk cryptocurrency wallet phishing site designed to deceive users into disclosing USDT (Tether) wallet credentials or transferring funds under the pretense of a "USDT Savings" scheme. The page title explicitly references USDT, a stablecoin commonly targeted in phishing campaigns due to its liquidity and widespread use in decentralized finance (DeFi) ecosystems. Analysis indicates the domain employs social engineering tactics to mimic legitimate savings or staking platforms, likely prompting victims to connect wallets or input private keys, resulting in unauthorized fund transfers or account takeovers. Infrastructure analysis reveals multiple technical indicators supporting the classification of this domain as malicious. The domain was registered on April 6, 2026, through Gname.com Pte. Ltd., a registrar frequently associated with newly created phishing domains. It resolves to the IP address 118.107.28.253, which has been flagged in prior malicious campaigns. Detection metrics further substantiate the threat: 14 out of 95 security vendors on VirusTotal classify the domain as malicious, while it appears on three independent security blocklists. Additionally, the domain is flagged for "SOCIAL_ENGINEERING" by Google Safe Browsing and is included in one threat intelligence pulse on AlienVault OTX, indicating cross-platform recognition of its fraudulent nature. Users who have visited onchainusdt.cc or interacted with its content should immediately take remedial actions to mitigate potential compromise. Any credentials, private keys, or wallet addresses entered on the site should be considered exposed and invalidated. Affected users are advised to transfer remaining funds to a new, secure wallet and monitor connected accounts for unauthorized transactions. System scans using updated security tools are recommended to detect potential malware or backdoors installed during the interaction. Given the domain's high-risk classification and offline status, users should remain vigilant for similar phishing attempts targeting cryptocurrency assets, particularly those leveraging fake savings or staking incentives.