drugon[.]cc

The domain drugon.cc has been identified as a high-risk generic phishing site. No specific brand impersonation or drainer kit has been detected, but the site is actively engaged in phishing activities, potentially targeting a broad audience. The domain's infrastructure and activity suggest it is part of a sophisticated phishing campaign.

Analysis indicates that drugon.cc has been flagged by 2 out of 95 security vendors on VirusTotal, suggesting a low level of detection but a high level of threat. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 91.206.71.162, which is located in the Netherlands and associated with Walker Web Development Services. The domain was created on May 20, 2026, and currently holds an SSL certificate issued by Google Trust Services / WE1. Additionally, the domain appears on 1 security blocklist and is blocked by PhishDestroy, indicating some level of awareness and action by security communities.

The current status of drugon.cc is active, posing a significant risk to potential victims. It is recommended that users avoid accessing this domain and that network administrators block traffic to this IP address. Despite the low detection rate, the presence of an SSL certificate and the domain's association with known web development services in the Netherlands suggest a well-organized and possibly long-term phishing operation. Continuous monitoring and updating of security measures are advised to mitigate the remaining risk.