# krslon5.cc — SUSPICIOUS

> krslon5.cc is a crypto drainer domain flagged by 2 of 95 VirusTotal vendors. Immediate block recommended to prevent asset theft.

## Summary
PhishDestroy identifies krslon5.cc as an active crypto drainer domain. This domain remains operational and poses an elevated risk to users engaging with cryptocurrency platforms or wallets. Action is required to mitigate exposure.


This domain was flagged by 2 of 95 VirusTotal vendors at the time of analysis. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, krslon5.cc resolves to IP 188.114.97.3 and was created on February 19, 2026. The domain utilizes a Let's Encrypt SSL certificate, which does not indicate legitimacy. These factors contribute to its elevated risk classification.


Security teams and end users should block krslon5.cc at the network and browser levels. Conduct a sweep for any prior interactions with this domain, especially on crypto-related platforms. Report this domain to threat intelligence platforms and update blocklists. Exercise caution when accessing cryptocurrency services and verify URLs through official channels before any transaction.

## Threat Details
- Verdict: SUSPICIOUS
- Site status: unknown (HTTP ?)

## Domain Intelligence
- Registered: 2026-02-19 08:37:17
- Registrar: NICENIC INTERNATIONAL GROUP CO., LIMITED
- IP: 188.114.97.3

## Detection Status
- VirusTotal: 2 vendors flagged
- Google Safe Browsing: clean
- Blocklists: 0 hits

## Evidence
- Cloudflare Radar: https://radar.cloudflare.com/scan/7818190f-8d94-4dbb-b136-2a6009779b25
- PhishDestroy: https://phishdestroy.io/domain/krslon5.cc/
- LLM endpoint: https://phishdestroy.io/domain/krslon5.cc/llm.txt

## If You Visited This Site
1. Change any passwords you may have entered
2. Enable 2FA on all related accounts
3. Monitor your accounts for unauthorized activity
4. Report to: FBI IC3, Europol, local authorities

---
Report by PhishDestroy | https://phishdestroy.io/domain/krslon5.cc/
Last updated: 2026-03-24