slon10[.]at

PhishDestroy identifies slon10.at as an active crypto drainer domain currently under investigation for impersonating a legitimate brand to siphon cryptocurrency. The site leverages a drainer kit designed to intercept and redirect wallet transactions, posing a direct threat to users’ digital assets. No specific brand impersonation has been confirmed yet, but the attack vector aligns with common crypto-draining tactics targeting unsuspecting victims.

This domain resolves to IP 64.190.63.222 and operates with a valid SSL certificate issued by DigiCert Inc. VirusTotal currently reports 3/95 detections, indicating it has not yet been flagged by mainstream security tools. The domain was registered recently, though the exact creation date is not publicly disclosed. Registrar details and Google Safe Browsing (GSB) status remain unverified, but the absence of detections suggests it may be flying under the radar. The lack of blocklist entries further highlights the need for proactive monitoring.

The domain remains active as of the latest assessment, with no confirmed takedown or mitigation by hosting providers or security vendors. Users are strongly advised to avoid interacting with slon10.at and to verify suspicious links using PhishDestroy’s real-time scanning tools. While the immediate risk is classified as 'under investigation,' the lack of detections on VirusTotal and the domain’s recent activity elevate its potential danger. Remaining risk includes continued operation for crypto-draining campaigns until sufficient evidence is gathered for blacklisting or takedown.