ll-24[.]cc

PhishDestroy identifies ll-24.cc as an active crypto drainer domain designed to deceive users into transferring cryptocurrency to threat actor-controlled wallets. This domain impersonates legitimate crypto platforms to trick victims into authorizing fraudulent transactions. The drainer kit likely includes fake wallet connection prompts and transaction approval overlays to siphon funds without user awareness.

Technical analysis of ll-24.cc reveals a dangerous configuration: only 2 out of 95 VirusTotal security vendors flagged the domain, despite its malicious intent. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on December 29, 2024, the domain resolves to IP address 104.21.54.104. Notably, it holds a Google Trust Services SSL certificate, which attackers increasingly abuse to appear legitimate. The domain remains unlisted on major blocklists, increasing its potential reach to unsuspecting victims.

This domain maintains an elevated risk status with active threat activity. Immediate containment measures are recommended, including network-level blocking of the domain and IP address. Users should verify all crypto-related domains through official channels before engaging. While current detection rates are low, the sophistication of this threat demands heightened vigilance. Remaining risk factors include the domain's recent creation date and the absence of widespread blocklist coverage, making proactive protection essential for potential victims.