tradingonramp[.]com

tradingonramp.com has been flagged for active crypto drainer phishing activity, warranting an under investigation risk rating. This domain masquerades as a legitimate on-ramp service to deceive users into connecting crypto wallets or entering credentials, likely targeting cryptocurrency enthusiasts. The threat is currently classified as generic phishing due to its broad, non-targeted approach, though further analysis may refine this classification. PhishDestroy blocked this domain proactively, and it remains unflagged on VirusTotal, with 0 engines detecting malicious content out of 95 scans as of seed 50926d. This domain resolves to IP 157.173.209.30, hosted under a Let's Encrypt SSL certificate, which is commonly abused by threat actors to lend false legitimacy to phishing sites. The domain was registered on May 3, 2023, through GoDaddy.com, LLC, providing a relatively short operational window that may indicate opportunistic or disposable infrastructure. Despite its youth, tradingonramp.com has already appeared on 1 security blocklist, suggesting early detection by threat intelligence feeds. The absence of VirusTotal detections (5/95) highlights the evasiveness of this campaign, which may rely on low-volume operations or delayed signature updates to avoid detection. Mitigation for this threat requires immediate caution when encountering tradingonramp.com or similar domains. Users should verify URLs against PhishDestroy's blocklist before engaging and avoid connecting crypto wallets or entering sensitive information on untrusted sites. Organizations are advised to monitor DNS logs for traffic to 157.173.209.30 and block associated IP ranges proactively. Threat hunters should prioritize hunting for Let's Encrypt certificates tied to recently registered domains and correlate with GoDaddy registrations post-May 2023. Given the domain's low detection rate, signature-based defenses may be insufficient; behavioral analysis and reputation scoring are critical to preempting crypto drainer campaigns.