zeoncoin[.]com

PhishDestroy identifies zeoncoin.com as an active crypto drainer scam impersonating the ZeonCoin brand. The domain is engineered to trick users into connecting cryptocurrency wallets under false pretenses, with the goal of draining assets via malicious smart contracts or wallet-draining scripts. Threat actors are leveraging the trust in the legitimate-sounding 'ZeonCoin' name to deceive users into authorizing transactions that transfer funds directly to attacker-controlled wallets. No known drainer kit signatures have been published yet, but the operational pattern aligns with emerging 'approval phishing' campaigns targeting low-capitalization tokens.

Technical analysis reveals zeoncoin.com resolves to IP 172.67.204.127 and was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on May 16, 2025. The domain uses a Google Trust Services SSL certificate to appear legitimate, but VirusTotal currently shows 0/95 detections—indicating it remains under the radar of most automated scanners. At the time of analysis, no public blocklists (such as Google Safe Browsing, PhishTank, or OpenPhish) have flagged the domain, reinforcing the need for proactive user verification. The domain is less than one month old, suggesting a recent deployment consistent with opportunistic scam campaigns.

This domain remains active and under investigation as of June 2025. Users are strongly advised to avoid visiting zeoncoin.com or interacting with any associated links or tokens. PhishDestroy recommends manual verification using trusted sources and tools such as blockchain explorers or official project websites. Given the current lack of AV or blocklist detection, the risk remains elevated and escalating. Immediate action includes domain blocking at the network and DNS level, and public reporting to enhance community awareness. Remaining risk: high due to low detection coverage and active deployment.