slon2at[.]net

This domain, slon2at.net, is identified as a fake crypto wallet drainer designed to execute unauthorized transactions and steal digital assets from connected wallets. Analysis indicates the site mimics legitimate wallet interfaces, tricking users into entering sensitive credentials or approving malicious transactions. The threat specifically targets cryptocurrency holders by exploiting social engineering tactics, such as fake airdrop promotions or wallet verification scams, to gain access to private keys or seed phrases.

Infrastructure analysis reveals multiple high-confidence indicators of compromise. The domain was registered on February 23, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with malicious domains. It resolves to the IP address 188.114.97.3 and is currently flagged by 1 out of 95 security vendors on VirusTotal. Additionally, the domain appears on four security blocklists, including those maintained by independent threat intelligence platforms and cryptocurrency security providers. The SSL certificate, issued by Google Trust Services, does not mitigate the risk, as phishing domains commonly use valid certificates to appear legitimate.

Users who visited slon2at.net or interacted with its content should take immediate action to secure their assets. Disconnect any wallets linked to the site and revoke all active session approvals using a trusted blockchain explorer. Conduct a full security audit of connected devices for malware, particularly browser extensions or applications that may have been installed during the interaction. Monitor all wallet addresses for unauthorized transactions and report any suspicious activity to relevant blockchain security teams. If credentials or private keys were entered, migrate funds to a new wallet immediately and consider the original wallet compromised.