onchainpak[.]net

The domain onchainpak.net has been identified as a generic phishing threat. This domain poses a significant risk due to its potential to deceive users into disclosing sensitive information such as login credentials or financial data. The domain does not appear to be associated with any specific brand or drainer kit, indicating a more generic phishing campaign designed to target a broad audience.

Infrastructure analysis reveals that onchainpak.net was flagged by 1 out of 95 security vendors on VirusTotal, suggesting a low but notable level of suspicion. The domain is registered through GoDaddy.com, LLC, and resolves to the IP address 188.114.97.3. It was created on October 28, 2025, and its SSL certificate is issued by Google Trust Services / WE1. The domain appears on 2 security blocklists, further indicating its malicious nature. The Google Safe Browsing (GSB) status of the domain is not explicitly mentioned, but its presence on blocklists suggests it may have been flagged by GSB as well.

Currently, onchainpak.net is offline, which has reduced the immediate risk it poses to users. However, the domain's history and technical indicators suggest that it has been used for malicious purposes. Security teams should monitor for any signs of the domain coming back online and consider adding it to their blocklists to prevent potential future attacks. Users should be cautious of any links or communications related to this domain and avoid interacting with it until it is thoroughly vetted and confirmed safe.