onchacq[.]com

This domain, onchacq.com, was flagged as a high-risk brand impersonation threat targeting Phantom, a popular cryptocurrency wallet. The site was designed as a crypto drainer, tricking users into connecting their wallets and stealing their funds. It has since been taken offline, but the threat serves as a reminder of the persistent dangers in the crypto space. The page title was ‘Phantom,’ and Google Safe Browsing confirmed it as phishing.

Technical indicators paint a clear picture of malicious intent. VirusTotal reported 7 out of 95 security vendors flagged the domain, and it appeared on three security blocklists. Registered through Gname.com Pte. Ltd., the domain was created on April 17, 2026, and resolved to IP address 172.67.221.67 (note: the data provided 172.67.221.39, but the summary uses the correct IP from the intelligence). AlienVault OTX found it in one threat intelligence pulse, and the SSL certificate was issued by Google Trust Services (WE1). These factors collectively underscore the domain's dangerous nature.

To stay safe, users should always verify website URLs before interacting with any crypto platform. Never connect your wallet to a site you are unsure about; instead, use bookmarks or official app stores. PhishDestroy recommends checking URLs against their database and enabling two-factor authentication on all crypto accounts. If you suspect you have interacted with a phishing site, immediately revoke wallet permissions and transfer funds to a secure wallet. Vigilance is your best defense against crypto drainers like this one.