ssn24[.]cc

Analysis of ssn24.cc shows a high‑risk phishing infrastructure that is currently active. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and resolves to IP address 188.114.96.3, which belongs to Cloudflare, Inc. (AS13335) and is geolocated to the United States. The site responds with HTTP status code 200 and presents a page titled “Just a moment…”, indicating a possible interstitial or check page, but no SSL certificate is deployed, leaving traffic unencrypted. Nameserver records point to ns3.my-ndns.com and ns4.my-ndns.com, which are typical of domains that rely on third‑party DNS providers for rapid changes.

Reputation scoring from Gridinsoft is 36 / 100, reflecting a low trust rating. VirusTotal has flagged the domain with 5 detections out of 93 scanned vendors, and it appears on one external security blocklist. PhishDestroy also lists ssn24.cc as blocked, reinforcing its malicious classification.

While the exact payload or credential‑capture mechanism has not been publicly disclosed, the combination of a recent registration, low trust score, lack of TLS, and multiple independent detections provides strong evidence of a phishing operation. Defenders should block the domain at network perimeters, add the IP address 188.114.96.3 to deny lists, and monitor DNS queries for the associated nameservers. Continuous re‑scanning with sandbox and endpoint tools is advised to capture any evolving payloads, and any observed credential submissions should be treated as compromised.