xn--sln10-1ta[.]cc

This domain, xn--sln10-1ta.cc, is flagged as an active credential theft phishing site impersonating Salone, a financial services provider. Analysis of the punycode-encoded domain (xn--sln10-1ta.cc) reveals an attempt to mimic legitimate Salone branding, likely targeting users through fraudulent login portals or account verification pages. No direct association with known crypto drainer kits has been confirmed, but the domain’s structure and behavior align with credential harvesting campaigns aimed at stealing sensitive financial or personal data. Infrastructure analysis reveals the following technical indicators: the domain was registered on April 18, 2026, through DYNADOT LLC and currently resolves to the IP address 193.17.182.202. VirusTotal detection shows 2 out of 95 security vendors flagging the domain as malicious, indicating limited but confirmed detection. The SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious domains due to its free and automated issuance process. Google Safe Browsing (GSB) status is not explicitly provided, but the low detection rate on VirusTotal suggests it may not yet be widely blocklisted. No additional blocklist data is currently available. The domain remains active as of the latest verification, posing a continued risk to users who may encounter it through phishing emails, malicious advertisements, or compromised redirects. Response actions should include immediate blocking of the domain and IP at the network level, along with monitoring for related infrastructure (e.g., subdomains or newly registered lookalike domains). Users who may have interacted with the site should be advised to reset credentials for any accounts accessed during the potential exposure window, particularly those associated with financial services. The risk level remains high due to the domain’s active status and targeted impersonation of a trusted brand.