slon10--cc[.]icu

PhishDestroy identifies slon10--cc.icu as an active crypto drainer domain under investigation for fraudulent digital asset theft. The threat type is specifically a cryptocurrency drainer, designed to silently siphon funds from unsuspecting victims' wallets. This domain is not merely a generic phishing page but an actively monitored drainer site with confirmed malicious infrastructure. Immediate action is required to block access and prevent financial loss. This domain was flagged by PhishDestroy with a risk level status marked as under_investigation. Intelligence shows a VirusTotal detection score of 3 out of 95 engines, indicating it has evaded current antivirus signatures. The domain resolves to IP address 104.21.14.243, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 10, 2026. The site uses a Let's Encrypt SSL certificate, which may lend false credibility, and has not yet been flagged by major blocklists despite its malicious nature. Trust scores for the domain and associated infrastructure remain critically low due to the lack of detections and recent creation date. To mitigate risks associated with crypto drainer domains like slon10--cc.icu, users should immediately block the domain and IP address 104.21.14.243 at the network or DNS level. Cryptocurrency users should verify website authenticity via official channels and use hardware wallets for transactions. Organizations should update firewall rules and security policies to block known drainer domains. Continuous monitoring of newly registered domains with similar naming patterns is recommended to prevent future exposure. Reporting the domain to security vendors and relevant blocklists can help protect the broader community from this threat.