slushwalletdesktop[.]app

PhishDestroy identifies slushwalletdesktop.app as an active crypto drainer domain posing as a legitimate Slush Wallet service. This malicious site is designed to trick users into connecting their cryptocurrency wallets and illicitly drain funds through deceptive transaction prompts. The elevated risk level warrants immediate action, as unpatched exposure could result in irreversible financial loss.

This domain exhibits multiple red flags across technical and behavioral indicators. VirusTotal analysis reveals 4 out of 95 security vendors have flagged the domain as malicious. The infrastructure analysis shows registration through NICENIC INTERNATIONAL GROUP CO., LIMITED, with hosting on IP address 216.198.79.1. The domain was created on March 21, 2026, which indicates extremely recent deployment—a common tactic among threat actors to evade established blocklists. Security blocklists including SEAL and MetaMask have already blacklisted this domain, and its SSL certificate issued by Let's Encrypt provides a false sense of legitimacy while enabling encrypted malicious traffic.

Mitigation requires immediate defensive actions aligned with crypto drainer threats. Users should block slushwalletdesktop.app at the network and DNS levels, and avoid accessing the domain entirely. For organizations, implement strict allowlisting of cryptocurrency wallet domains and deploy endpoint protection capable of detecting wallet connection prompts. Always verify domain URLs through official channels before connecting wallets, and educate users on the risks of deceptive wallet interfaces. Consider reporting this domain to threat intelligence platforms to enhance collective defense.