slokn6[.]cc

PhishDestroy identifies slokn6.cc as an active credential phishing domain posing elevated risk to end users. This domain was flagged by 2 of 95 security vendors on VirusTotal, indicating low but notable detection coverage. The domain resolves to IP address 141.98.234.104 and uses a Let's Encrypt SSL certificate, which may mislead users into trusting the site. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on February 19, 2026, this domain represents a recent threat actor acquisition with minimal third-party scrutiny. The domain demonstrates several red flags consistent with phishing infrastructure. It has a minimal detection rate of 2/95 on VirusTotal, a low-risk score that suggests limited exposure to security vendors. Registration occurred via NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar known for accommodating high-risk domains. The domain points to a dedicated IP (141.98.234.104) with no apparent hosting history, and its SSL certificate from Let's Encrypt may provide false legitimacy. Created within the last month, slokn6.cc has not yet appeared on major blocklists, indicating an early-stage campaign. Mitigation requires immediate action from both users and security teams. Users should avoid any interaction with this domain, including clicking links or entering credentials. Security teams should block 141.98.234.104 at network boundaries and monitor for associated indicators, including the domain itself and any derived URLs. Consider reporting this domain to browser blocklists and threat intelligence platforms to increase detection coverage. As this appears to be a new campaign, proactive blocking reduces the risk of successful credential harvesting. Monitor for related infrastructure such as similar domains registered through the same registrar or hosted on the same IP range.