slon6-cc[.]org

PhishDestroy identifies slon6-cc.org as an active crypto-draining domain deployed to siphon STX (Stacks) and other cryptocurrencies from unsuspecting users. The site masquerades as a legitimate STX airdrop or promotion page, prompting wallet connections and triggering malicious drainer scripts upon authorization. Wallet signatures captured by the drainer are automatically forwarded to attacker-controlled addresses, resulting in near-instant token and NFT depletion while the user remains unaware until transaction confirmations appear on-chain. This domain was flagged on April 02, 2026—just days after creation—registered via Cloudflare, Inc. and served over IP 168.100.8.206 under a Let’s Encrypt SSL certificate. VirusTotal currently scores it 1/95 detections, indicating it has evaded mainstream antivirus engines. The absence of detections suggests either a very new payload or deliberate obfuscation tactics designed to bypass signature-based defenses. Given the rapid domain lifecycle and cryptocurrency targeting, it aligns with the operational patterns of high-velocity crypto drainer campaigns that exploit FOMO around new token launches. If you visited slon6-cc.org or connected a wallet to any page on this domain, immediately revoke all active wallet approvals using tools such as Revoke.cash or Token Approval Checker. Transfer any remaining assets to a cold wallet not exposed to the internet. Report the incident to your wallet provider and consider filing a complaint with local cybercrime units or platforms like Chainalysis or CipherTrace. Block the domain at firewall or DNS level and monitor on-chain activity for unauthorized transfers.