onetreeplan[.]xyz

PhishDestroy identifies onetreeplan.xyz as an active phishing site that mimics the legitimate One Tree Plan brand to steal user credentials and payment details. The domain is designed to look like the real One Tree Plan service, luring visitors into entering personal information or financial data under false pretenses. This impostor site aims to harvest logins, credit card numbers, and other sensitive data for identity theft and fraudulent transactions. The moment the page loads, it may prompt downloads of malicious scripts or redirect victims to other harmful domains to escalate the attack.

This domain was flagged by PhishDestroy after VirusTotal detected 6 out of 95 security vendors marking it malicious. The domain was registered on March 04, 2025, through NameSilo, LLC, and uses a Google Trust Services SSL certificate to appear legitimate. It resolves to IP address 188.114.97.3, a known hosting node linked to multiple phishing campaigns. These technical indicators—low age, bulletproof registrar choice, and suspicious SSL issuance—are consistent with newly spun-up phishing infrastructure dedicated to brand impersonation.

If you visited onetreeplan.xyz, stop entering any information immediately. Close the browser tab and clear your cookies and cached data. Run a full antivirus scan using up-to-date software and enable two-factor authentication on all accounts you may have used while on the site. Notify your bank or card issuer if you entered payment details. Report the domain to your email provider and consider using a password manager to detect fake login prompts in the future. Share this alert with friends or colleagues who might recognize the One Tree Plan service to prevent further victims.