onchainvty[.]com

This domain, onchainvty.com, operates as a crypto drainer scam designed to compromise digital wallets and siphon cryptocurrency assets. The site mimics legitimate blockchain services, using deceptive interfaces to trick users into connecting their wallets. Once connected, malicious scripts execute unauthorized transactions, transferring funds to attacker-controlled addresses without user consent. The threat specifically targets users of decentralized finance (DeFi) platforms and wallet extensions, exploiting trust in on-chain interactions. Analysis of the domain reveals multiple high-risk indicators. The domain was registered on October 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious infrastructure. It resolves to IP address 172.67.220.34, hosted on AS13335 (Cloudflare, Inc.), a network commonly used to obfuscate attacker origins. Security vendors on VirusTotal flag the domain as malicious, with 11 out of 95 engines detecting it. Additionally, the domain appears on three security blocklists, including those maintained by cryptocurrency security providers. The SSL certificate, issued by Google Trust Services (WE1), does not mitigate the risk, as legitimate certificates are routinely used in phishing campaigns to appear trustworthy. Users who have visited onchainvty.com or interacted with its content should take immediate action to secure their assets. Disconnect any wallets linked to the site and revoke all connected dApp permissions using wallet management tools. Scan the device for malware, as crypto drainers may deploy additional payloads. Monitor wallet activity for unauthorized transactions and transfer remaining funds to a new, secure wallet if compromise is suspected. Report the domain to relevant security teams and cryptocurrency platforms to prevent further exploitation. Avoid re-engaging with the domain or similar sites, and verify all blockchain interactions through official, verified channels.