slon3-----cc[.]vip

PhishDestroy identifies slon3-----cc.vip as an active Slack credential phishing domain under investigation. This domain is currently distributing a fake Slack login page designed to harvest corporate credentials. Users arriving at this site via phishing emails, malicious ads, or typosquatting links are prompted to enter their Slack credentials, which are then transmitted to the attacker’s server. The site is operational and poses a significant risk to organizations using Slack, especially those with remote or hybrid workflows that rely heavily on the platform for communication.

This domain was flagged by 3 of 95 VirusTotal security vendors at time of analysis, indicating that while undetected by most AV engines, its malicious nature has been independently verified through behavioral and infrastructure analysis. slon3-----cc.vip resolves to IP address 64.7.198.31, is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, and was created on April 18, 2026. It uses a valid SSL certificate issued by Let’s Encrypt, which increases its deceptive appearance and enables encrypted data exfiltration of stolen credentials. The domain is not yet listed on major blocklists, reflecting its recent emergence and the lag in threat intelligence feeds.

The current status of slon3-----cc.vip is active and its infrastructure is stable. Given the absence of AV detections and blocklist inclusion, organizations are strongly advised to implement domain-based monitoring and block this domain at network firewalls and DNS resolvers immediately. Users should avoid interacting with this domain and be alert for phishing emails impersonating Slack. If credentials have been entered, users must rotate passwords immediately and enable multi-factor authentication (MFA). Consider reporting incidents to Slack’s Trust & Safety team using the phishing submission form at slack.com/help/requests. Proactive threat hunting based on IP 64.7.198.31 and SSL fingerprint is recommended to identify lateral compromise or credential reuse across systems.