slon228[.]cc

The domain slon228.cc is currently under investigation for brand impersonation, specifically targeting the cryptocurrency exchange Kraken. This domain was identified as potentially malicious due to its use of the page title 'kraken', which suggests an attempt to deceive users into believing they are interacting with the legitimate Kraken website. Although no specific drainer kit has been identified, the threat type is consistent with brand impersonation tactics commonly used in phishing schemes.

Technical analysis of slon228.cc reveals several key indicators. The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and was created on March 24, 2026. Despite its recent creation, the domain has already been blocked by PhishDestroy and appears on one security blocklist. VirusTotal analysis shows 0/95 detections, indicating that it has not yet been flagged by most security engines. The domain resolves to the IP address 64.111.92.48 and uses an SSL certificate issued by Let's Encrypt. It has also been mentioned in two threat intelligence pulses on AlienVault OTX.

Currently, slon228.cc is offline, which mitigates the immediate risk of exposure to end users. However, the potential for future exploitation remains if the domain comes back online or if similar domains are registered. Security teams should continue monitoring for any new developments related to this domain and ensure that similar domains are preemptively blocked. Users are advised to verify the authenticity of any communication or website purporting to be associated with Kraken to avoid falling victim to impersonation attacks.