slon10t[.]cc

PhishDestroy identifies slon10t.cc as an active credential-phishing site designed to mimic a legitimate login interface and trick users into surrendering usernames and passwords. When victims enter their credentials, attackers capture the data in real time and can immediately abuse the stolen accounts to access email, banking, or corporate resources. The domain resolves to IP 188.114.97.3 and currently shows zero detections out of 95 VirusTotal engines, indicating that signature-based defenses have not yet been updated to block this threat.

This domain was flagged on February 23, 2026—less than 48 hours ago—by a registrar under NICENIC INTERNATIONAL GROUP CO., LIMITED. The SSL certificate issued by Let’s Encrypt adds a veneer of legitimacy, but the site has no legitimate business presence and was registered only to host phishing content. The combination of a brand-new domain, low detection coverage, and active hosting on a bulletproof-friendly IP range increases the risk that unsuspecting users will fall victim before automated defenses catch up.

If you visited slon10t.cc, assume your credentials may have been exposed. Immediately change the password on that site and enable multi-factor authentication wherever possible. Scan your devices with a reputable anti-malware product and review recent login sessions for any unauthorized access. Report the domain to your security team or local CERT and avoid any future visits. The longer the site remains active, the higher the chance it will be weaponized further, so act quickly to contain any potential damage.