onstreamz[.]com[.]in

Analysis indicates that the domain onstreamz.com.in is actively engaged in crypto drainer phishing operations as of July 12, 2026. The domain was registered on April 30, 2026, through the National Informatics Centre, a registrar that has been recurrently associated with phishing infrastructure. Infrastructure analysis reveals the domain resolves to the IP address 188.114.97.3, hosted under Cloudflare, Inc. in Canada, a provider frequently utilized to obscure malicious endpoints. Nameservers becky.ns.cloudflare.com and piers.ns.cloudflare.com further confirm Cloudflare’s role in the domain’s hosting and traffic routing. The site presents a page title 'Zarchiver - Create, Extract & Manage Compressed Archive Files,' which does not align with the identified scam type of crypto draining. This discrepancy suggests either a cloaking mechanism or a repurposed legitimate service facade to evade detection. The domain is currently flagged by three security blocklists, including PhishDestroy, MetaMask, and SEAL, and maintains an active HTTP 200 status, indicating operational availability. The SSL certificate is issued by Google Trust Services (WE1), a common certificate authority for both legitimate and malicious domains, providing no definitive indication of intent. Technical fingerprinting identifies WordPress, MySQL, PHP, Yoast SEO, and Cloudflare Browser Insights as the underlying technologies. The presence of WordPress, a widely exploited content management system, may facilitate rapid deployment of phishing content. Gridinsoft assigns a trust score of 0/100, reinforcing the domain’s high-risk classification. While one of ninety-one security vendors on VirusTotal flags the domain, this limited detection does not diminish the confirmed active status and blocklist presence. Defenders should treat this domain as a confirmed crypto drainer phishing endpoint. Network-level blocking of the IP 188.114.97.