# PhishDestroy domain threat record: slon5.kr Content language: English Canonical HTML report: https://phishdestroy.io/domain/slon5.kr/ Machine-readable companion: https://phishdestroy.io/domain/slon5.kr/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-08-31 09:49:25 UTC - Last availability or vendor check: 2026-10-21 22:32:53 UTC - Stored record updated: 2026-10-22 14:24:16 UTC - VirusTotal detections in the stored snapshot: 6/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.3 - Registrar in stored WHOIS data: Whois Corp.(http://whois.co.kr) - Registration date (registry RDAP, slon5.kr): 2026-03-11 15:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a05738-6e60-706c-be68-3b1ebda1d9bc/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/slon5.kr - Certificate Transparency search: https://crt.sh/?q=%25.slon5.kr - Web Archive lookup: https://web.archive.org/web/*/https://slon5.kr/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview slon5.kr is a South Korean country-code domain that PhishDestroy added to its blocklist on 2026-08-31. No impersonated brand or specific scheme has been confirmed for it yet, so it is listed as suspicious rather than tied to a known scam type. The site went offline on 2026-09-11 and was still unreachable when last checked on 2026-10-19. How the scam works Without a confirmed classification, the specific fraud method behind slon5.kr is not established. The risk comes from the way several independent threat-intelligence sources converged on it. Domains flagged this way are typically used to collect logins, push malicious downloads, or lure crypto users into handing over wallet access or funds. Anyone who reached the site while it was live should assume that whatever they typed or approved there may have been captured. Evidence VirusTotal shows 6 of 89 engines flagging the domain as of 2026-09-11. The flagging vendors are alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. That is a minority of engines, but the detections come from unrelated reputation and phishing feeds rather than a single source. The domain also appears in four AlienVault OTX threat pulses, which means other researchers have tracked it as part of reported malicious activity. Among blocklists, only PhishDestroy currently carries it. Infrastructure The domain was registered on 2026-03-12 through Whois Corp. It surfaced on PhishDestroy's radar about five and a half months later. That gap suggests the name was held for a while before it was put to visible use. Traffic was routed through Cloudflare, with the edge address geolocated to Canada, so the real origin server is hidden from view. The site dropped offline on the same day as the latest VirusTotal check, less than two weeks after PhishDestroy first saw it. What to do If you visited slon5.kr and entered a password, change it on that service and anywhere you reused it, then turn on two-factor authentication. If you shared any wallet details or a recovery phrase there, move your assets to a newly created wallet. Watch your accounts for logins or transfers you did not make. Security teams should block the domain and review DNS and proxy logs for contact with it between 2026-08-31 and 2026-09-11. Because the domain remains registered, it could come back online, so blocking it now is worthwhile. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a05738-6e60-706c-be68-3b1ebda1d9bc/ VirusTotal report: https://www.virustotal.com/gui/domain/slon5.kr Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=slon5.kr Archived copy: https://web.archive.org/web/20260831095039/https://slon5.kr/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:52:58 UTC ## Stored page captures - Primary capture: https://i.ibb.co/KjhLRSF0/3b3b47fb15b2.png Captured: 2026-08-31 09:49:25 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a05738-6e60-706c-be68-3b1ebda1d9bc.png Captured: 2026-08-31 09:49:25 UTC Source report: https://urlscan.io/result/01a05738-6e60-706c-be68-3b1ebda1d9bc/ ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T04:25:45Z", "uuid": "01a05738-6e60-706c-be68-3b1ebda1d9bc", "scanned_at": "2026-08-31T09:48:46Z", "final_url": "https://slon5.kr/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://slon5.kr/", "from": "http://slon5.kr/", "status": 307 }, { "to": "https://slon5.kr/", "from": "https://slon5.kr/" } ], "ip": "188.114.96.3", "ips": [ "188.114.96.3", "2a06:98c1:3121::3" ], "asns": [ "13335" ], "doc_hash": "e5fa8deec523fdbd8019fc54ec29382cb812fca0eec65aae9c4588437641b297", "script_hashes": [ "10a50430d5ba794708dc4279299ca9c73e281ab09fe2847e2b55f68c21177cc8" ], "globals": [ "ontouchcancel", "ontouchend", "ontouchmove", "ontouchstart", "slowAES", "toNumbers", "toHex", "a", "b", "c" ], "cookies": [ "connecting", "fuck_you", "TCK" ], "tls": { "san": [ "*.slon5.kr", "slon5.kr" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "slon5.kr", "protocol": "TLS 1.3", "valid_to": "2026-10-17T15:10:46Z", "valid_from": "2026-07-19T15:10:47Z" }, "domain_age_days": 101, "apex_age_days": 101, "tls_age_days": 42, "tls_valid_days": 89, "requests": 5, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 80, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "x-powered-by": "PHP/8.5.0", "strict-transport-security": "max-age=0" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T04:37:00Z", "uuid": "a47b0b63-2309-47e7-a4b1-6df04331ba3e", "scanned_at": "2026-08-31T10:30:04Z", "final_url": "https://slon5.kr/", "status": 200, "history": [ { "url": "https://slon5.kr/", "status": 200 } ], "dom_hash": "7755c342864988cd1cfd5978d4469462b09bdf8afbcaecde72638ffa49176ea2", "doc_hash": "bb0162edb5275bf26a5f4fea4087dffb6278ec371095dd8d269aa9a9d7906adb", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "slon5.kr", "type": "A", "value": "104.21.73.33" }, { "name": "slon5.kr", "type": "A", "value": "172.67.157.112" }, { "name": "slon5.kr", "type": "AAAA", "value": "2606:4700:3030::ac43:9d70" }, { "name": "slon5.kr", "type": "AAAA", "value": "2606:4700:3033::6815:4921" } ], "dnssec_valid": false, "ip": "104.21.73.33", "whois": { "registrar": "Whois Corp.(http://whois.co.kr)", "created": "2026-03-12T00:00:00Z", "updated": "2026-08-14T00:00:00Z", "expires": "2027-03-12T00:00:00Z", "nameservers": [ "marjory.ns.cloudflare.com", "mustafa.ns.cloudflare.com" ] } } } ```