# formnscosttmerlyan.hazelnutindo.com — MALICIOUS

> Beware! formnscosttmerlyan.hazelnutindo.com is a crypto drainer scam detected by 12/95 VirusTotal vendors.

## Summary
PhishDestroy identifies formnscosttmerlyan.hazelnutindo.com as an active crypto drainer posing as a customer care portal for the DANA cryptocurrency platform. This fraudulent domain mimics legitimate DANA support interfaces to trick victims into connecting cryptocurrency wallets, resulting in immediate fund drainage through malicious smart contract interactions. The site employs deceptive branding using stylized Unicode characters in page titles to evade text-based detection filters, while leveraging social engineering tactics to appear as official customer support.

This domain was flagged by 12 out of 95 VirusTotal security vendors, indicating elevated malicious activity. It was registered through NameSilo, LLC on March 26, 2026, with a Let's Encrypt SSL certificate providing false legitimacy. The domain resolves to IP address 104.21.4.247, which hosts multiple other flagged crypto scam domains. Independent threat intelligence sources report 8 additional blocklist detections from cryptocurrency security platforms focused on wallet drainage prevention.

Users who have visited this domain should immediately disconnect any connected wallets, revoke any potentially malicious token approvals through blockchain explorers like Etherscan or BscScan, and conduct a full security audit of their cryptocurrency holdings. The domain should be blocked at the network level through hosts file modification or firewall rules. For comprehensive protection, users should install PhishDestroy's browser extension to automatically block future access to this and similar crypto drainer domains. Report any unauthorized transactions to your wallet provider immediately and consider transferring remaining funds to a newly generated wallet address.

## Threat Details
- Verdict: MALICIOUS
- Site status: unknown (HTTP ?)
- Page title: 𝗗𝗔𝗡𝗔 | 𝗖𝘂𝘀𝘁𝗼𝗺𝗲𝗿 𝗖𝗮𝗿𝗲 𝗗𝗔𝗡𝗔

## Domain Intelligence
- Registered: 2026-03-26 14:12:50
- Registrar: NameSilo, LLC
- IP: 104.21.4.247

## Detection Status
- VirusTotal: 12 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/d717cfd8-7b91-48d0-bac5-4e7ae9ab8907
- PhishDestroy: https://phishdestroy.io/domain/formnscosttmerlyan.hazelnutindo.com/
- LLM endpoint: https://phishdestroy.io/domain/formnscosttmerlyan.hazelnutindo.com/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/formnscosttmerlyan.hazelnutindo.com/
Last updated: 2026-03-30