onlconnect[.]com

PhishDestroy identifies ONLCONNECT.com as an active brand impersonation domain currently under investigation for credential theft, specifically targeting cryptocurrency users through deceptive login interfaces. This domain is not yet flagged by VirusTotal vendors, but its association with crypto-related phishing tactics and suspicious infrastructure warrants immediate scrutiny. Security researchers recommend treating it as a high-risk threat until further validation is completed. This domain was flagged by 9 of 95 VirusTotal vendors. It is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, resolves to IP 188.114.97.3, and was created on April 10, 2026. The domain holds a valid SSL certificate issued by Let's Encrypt, and its recent creation date, combined with zero detections, suggests a potentially emerging or evolving threat vector. The absence of blocklist entries further indicates a need for proactive monitoring. The current status of ONLCONNECT.com remains active, with no confirmed blocklist presence at this time. Users are strongly advised to avoid interacting with this domain, especially when prompted for cryptocurrency wallet credentials or login details. Organizations and security teams should implement network-level blocking for the associated IP address (188.114.97.3) and monitor for any connections to this domain. If accidental exposure occurs, users should immediately revoke any entered credentials, transfer remaining assets to a secure wallet, and conduct a full security audit of their crypto holdings. Given the zero VirusTotal detections, this domain may bypass traditional security filters, making user vigilance and manual verification critical.