spcx-ondo-finance[.]com

This domain, spcx-ondo-finance.com, is flagged as an active crypto drainer phishing site designed to deceive cryptocurrency users. Analysis indicates the site impersonates legitimate token price tracking platforms, specifically targeting holders of SPCXon or similar assets. The page title, 'SPCXon Token Price & Chart,' suggests an attempt to mimic authentic financial data providers, a common tactic in crypto drainer schemes where victims are tricked into connecting wallets to malicious smart contracts. No direct brand impersonation of a major entity is evident, but the domain structure and content align with known drainer kit infrastructure, likely leveraging social engineering to exploit users seeking token analytics. Infrastructure analysis reveals multiple high-risk technical indicators. The domain resolves to IP address 104.21.71.84, hosted on Cloudflare’s network (AS13335), a frequent choice for phishing operators due to its anonymity and resilience. It was registered on June 12, 2026, through Gransy, s.r.o., a registrar often associated with fraudulent domains. The SSL certificate, issued by Google Trust Services (WE1), is valid but does not mitigate the underlying threat. Security vendors on VirusTotal flagged the domain 11 times out of 95 scans, and it appears on three independent blocklists, including PhishDestroy and SEAL. Google Safe Browsing status is not provided, but the domain’s presence on multiple blocklists further confirms its malicious classification. As of the latest assessment, spcx-ondo-finance.com remains active and poses a high risk to users. The site’s infrastructure and content suggest it is part of an ongoing crypto drainer campaign, with no evidence of takedown or mitigation. Users are advised to avoid interacting with the domain, block all connections to 104.21.71.84, and verify token-related information through official project channels. Wallet providers and security platforms should prioritize blocking this domain and its associated IP to prevent further exploitation. Given the domain’s recent creation and continued activity, heightened vigilance is recommended for cryptocurrency holders, particularly those engaging with lesser-known or emerging tokens.