valo-luck[.]cc

PhishDestroy identifies valo-luck.cc as a recently activated crypto-drainer domain engineered to steal private keys and seed phrases from cryptocurrency wallets. The site masquerades under a luck-themed branding intended to lure victims seeking “good fortune” or quick gains. Based on cluster telemetry, the domain is currently paired with a first-stage luring campaign targeting Discord and Telegram communities via fake “airdrop” or “giveaway” links that redirect to valo-luck.cc for wallet connection approvals. valo-luck.cc resolves to IP 186.2.171.13 and is backed by a Let’s Encrypt SSL certificate. The domain was created on April 05, 2026—less than 72 hours ago—through PDR Ltd. d/b/a PublicDomainRegistry.com. Current sandbox analysis via VirusTotal shows 0 detections out of 95 engines, indicating the payload remains largely undetected by signature-based defenses. Google Safe Browsing (GSB) has not yet blacklisted the URL, and public blocklists such as PhishTank and OpenPhish currently list zero entries for valo-luck.cc, suggesting rapid egress into victim inboxes. The domain is flagged as active under seed 007a8f and will be under continuous monitoring until threat indicators stabilize. Users are urged to block valo-luck.cc at DNS and network layers, refrain from opening links promising “luck” or cryptocurrency bonuses, and verify wallet-connect requests via offline or hardware wallet confirmations only. Remaining risk is under investigation but is assessed as elevated due to the domain’s recent creation, untouched reputation, and proximity to active campaigns.