onchaindvfe[.]com

This domain, onchaindvfe.com, is actively targeting cryptocurrency users with a wallet drainer phishing scheme. The site mimics legitimate on-chain services to trick visitors into connecting their crypto wallets, enabling attackers to siphon funds without authorization. The threat is classified as high-risk due to its active status and direct financial impact on victims. Users who interact with this domain risk immediate asset loss, as the site is designed to execute unauthorized transactions upon wallet connection. Analysis indicates the domain was registered on October 19, 2025, through Gname.com Pte. Ltd., a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3, hosted on Cloudflare's infrastructure (AS13335), which is commonly exploited to obscure the true origin of phishing sites. VirusTotal detection shows 4 out of 95 security vendors flagging the domain as malicious, a low but notable ratio that suggests targeted evasion of detection systems. The SSL certificate, issued by Google Trust Services (WE1), provides a false sense of security, as phishing domains often use valid certificates to appear legitimate. If a user has visited onchaindvfe.com or connected a wallet to the site, immediate action is required. First, disconnect the wallet from all dApps and revoke any suspicious smart contract approvals using a blockchain explorer or dedicated revocation tool. Next, transfer remaining assets to a new, secure wallet address. Monitor transaction history for unauthorized activity and report the incident to relevant security teams or blockchain analytics platforms. Users should also scan their devices for malware, as phishing sites may deploy additional payloads. Given the domain's active status and presence on three security blocklists, continued avoidance is strongly advised.