onchain-vsip[.]com

The domain onchain-vsip.com has been identified as a crypto drainer phishing site, designed to steal cryptocurrency wallet credentials and drain funds from connected accounts. Analysis indicates the infrastructure was actively targeting users through deceptive web interfaces mimicking legitimate blockchain services. As of the latest verification, the domain has been taken offline, though residual risks may persist for users who interacted with it prior to its removal. Infrastructure analysis reveals the domain was registered on October 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with high-risk domains. It resolved to the IP address 188.114.96.3 and was protected by Cloudflare, utilizing technologies such as PHP, Vue.js, HSTS, and HTTP/3 to enhance its operational security and evade detection. The domain was flagged by 12 of 95 security vendors on VirusTotal, appeared on four security blocklists, and was explicitly blocked by multiple wallet security providers. Its SSL certificate was issued by Google Trust Services, adding a superficial layer of legitimacy. Gridinsoft assigned the domain a trust score of 0/100, further corroborating its malicious intent. The current status of onchain-vsip.com is offline, though the infrastructure may resurface under a different domain or IP configuration. Users who connected wallets or entered credentials on this site should assume compromise and take immediate action. Recommended steps include revoking all active wallet session approvals, transferring remaining assets to a new wallet address, and monitoring transaction histories for unauthorized activity. Organizations and individuals are advised to update blocklists with the domain and associated IP, and to conduct retrospective log analysis to identify potential prior interactions. Given the high-risk nature of crypto drainer threats, continuous vigilance and proactive security measures are essential to mitigate further exposure.