slon2----cc[.]vip

The domain slon2----cc.vip has been flagged by PhishDestroy as a generic phishing landing page actively impersonating legitimate cryptocurrency platforms. Intelligence indicates this domain leverages a drainer kit designed to silently siphon digital assets from unwitting users who engage with its fraudulent interfaces. The kit appears to be in active distribution, with no specific brand alignment detected yet, suggesting opportunistic targeting rather than a focused campaign against a single entity.

Technical indicators confirm this domain resolves to IP 199.217.99.9 and was registered on April 01, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. VirusTotal currently reports 5/95 detection coverage, indicating zero sandbox or antivirus engines have flagged the sample as malicious. The domain holds a valid Let’s Encrypt SSL certificate, enhancing its credibility. Analysis via Google Safe Browsing (GSB) and public blocklists remains negative, with no prior associations to known malware families or phishing repositories. These indicators suggest a recently deployed, minimally documented campaign with evasion tactics still in early stages.

As of today, slon2----cc.vip remains active and unblocked by major security vendors, with risk classification under active investigation. PhishDestroy recommends immediate network-level blocking of the domain and associated IP 199.217.99.9. Users are strongly advised to avoid any interaction with this domain, abstain from downloading files or engaging with its interfaces, and report any suspicious activity to their security teams. The low detection rate and fresh registration elevate the risk of successful compromise, warranting heightened vigilance. This advisory will be updated as additional intelligence emerges. Seed: f881fc