www-slash[.]co[.]com

This domain, www‑slash.co.com, was registered on 21 February 2026 through Moniker Online Services LLC. The registration is recent, and the domain is delegated to four authoritative name servers (ns1‑ns4.nic.co.com). The authoritative DNS resolves the domain to the single IPv4 address 169.60.151.233, which is hosted by SoftLayer Technologies, Inc. in Canada. An HTTPS service is available using a Let’s Encrypt certificate (issuer YE1), indicating that the operator has configured TLS for the host. The web server returns an HTTP 404 status, showing that no valid content is currently served at the root path. Despite the lack of a visible page, the domain has been flagged by 12 of 95 security scanners on VirusTotal, and it appears on five independent phishing blocklists, including PhishDestroy, Polkadot, Enkrypt, Codeesura, and PhishingDB. These listings collectively assign a high‑risk rating, and the domain is presently active. Analysis of the available infrastructure suggests the domain is being used as a phishing lure. The use of a generic, short‑hand domain, recent registration, and rapid inclusion on multiple blocklists are consistent with a campaign that aims to exploit the reputation of the .co.com second‑level namespace. However, no page content has been captured, and the specific target brand or credential‑stealing vector remains unknown. The presence of a valid TLS certificate and a 404 response may be an attempt to appear legitimate while avoiding immediate content inspection. Defenders should treat www‑slash.co.com as a high‑confidence phishing indicator. Immediate actions include adding the domain and its resolving IP address to network blocklists, configuring DNS‑level sinkholing, and monitoring for any outbound connections to the host. Continuous re‑resolution checks are advised, as the operator could deploy new content without altering the underlying IP. Logging of TLS handshake attempts can provide additional visibility into potential victim interactions.