slon--2[.]cc

PhishDestroy identifies slon--2.cc as a fraudulent domain currently active and propagating a generic phishing campaign. The domain is designed to deceive users into believing they have won a prize or promotional reward, then harvesting sensitive personal or financial information. No specific brand impersonation has been confirmed at this time; however, the site’s structure mimics common lottery or reward scam templates to lure victims.

Technical analysis of slon--2.cc reveals multiple red flags: it was registered on February 18, 2025, through NICENIC INTERNATIONAL GROUP CO., LIMITED, and resolves to IP address 104.21.2.203. The domain is secured with a Let's Encrypt SSL certificate, which does not indicate legitimacy. Most critically, VirusTotal analysis shows the domain is flagged by 3 of 95 participating security vendors, placing it under elevated scrutiny. While the domain is not widely blocklisted at this time, its recent creation and low trust indicators suggest rapid deployment in ongoing phishing operations.

Given this domain’s elevated risk status and confirmed malicious signals, PhishDestroy strongly recommends that users avoid accessing slon--2.cc entirely. Organizations should consider domain blocking via DNS filtering and update threat intelligence feeds to include this domain. Users who may have interacted with the site are advised to monitor financial accounts for unauthorized activity, reset passwords if credentials were entered, and report the incident to relevant authorities. Proactive user education on identifying online scams remains essential to reduce exposure to evolving phishing tactics.