slone3[.]at

PhishDestroy identifies slone3.at as an active crypto drainer domain, a specific type of phishing threat designed to steal cryptocurrency wallet credentials and drain victims' funds. The domain currently poses an elevated risk and is actively monitored for malicious activity. No specific brand impersonation was detected, but the domain's infrastructure aligns with known crypto phishing operations.

The domain was created on April 7, 2026, a relatively recent registration, which is typical for disposable phishing domains. It resolves to IP address 104.21.5.21 and uses an SSL certificate from Let's Encrypt (E8), a free certificate provider often abused by threat actors. VirusTotal flagged slone3.at by only 1 of 95 security vendors, indicating low detection rates that allow it to bypass many security filters. AlienVault OTX includes the domain in one threat intelligence pulse, and it appears on one security blocklist. These indicators suggest a targeted or emerging threat that may not yet be widely recognized.

Given its elevated risk level and active status, PhishDestroy recommends avoiding any interaction with slone3.at. Users who encounter this domain should not click any links, enter credentials, or connect cryptocurrency wallets. Organizations should block the domain at the network level and report it to relevant threat intelligence platforms. Continuous monitoring is advised as the domain may evolve or be used in broader campaigns.