slokn7[.]cc

PhishDestroy’s forensic review confirms that slokn7.cc is an active generic-phishing domain engineered to mimic a Russian construction-materials directory named ‘СтройКаталог’—‘Обзор магазинов стройматериалов России’. The site presents itself as a legitimate catalog of building-supply stores, aiming to harvest login credentials, bank-card data, or identity details from unsuspecting contractors or DIY buyers. No known drainer kit artifacts (e.g., JavaScript obfuscation or Telegram bot callbacks) were detected on first inspection, indicating the threat is primarily data-stealing rather than wallet-draining at this stage, though functionality may evolve rapidly.

Technical indicators corroborate elevated risk. VirusTotal flags the domain with a 2/95 detection ratio as of the seed 32547f collection window. It resolves to IP 141.98.234.104 and is hosted via a Let’s Encrypt SSL certificate. The domain was created on 19 February 2025—less than one month ago—and is sponsored by NICENIC INTERNATIONAL GROUP CO., LIMITED. Google Safe Browsing currently lists the domain as not present, and public blocklists (Abuse.ch, OpenPhish, PhishTank) contain zero direct references at the time of analysis, underscoring the novelty and rapid deployment cycle of this campaign.

The domain remains active and is actively resolving; registrant privacy protections mask true ownership, enabling continued operation. PhishDestroy has flagged slokn7.cc to all major browser vendors and security feeds, but the low VT score and absence from public blocklists mean end-users remain exposed until signatures propagate. Remaining risk is elevated: while no wipe-and-run drainer payload has been confirmed, the fake catalog facade can still trick visitors into submitting sensitive information. Users are advised to block the domain at the DNS level, refrain from clicking any links, and report the URL to their IT security team or national CERT immediately.