s-lon[.]lk

This domain, s-lon.lk, is flagged as a generic phishing site designed to impersonate the legitimate S-lon brand. Analysis of the page title, "Welcome - S-lon," indicates an attempt to deceive users into entering credentials on a fraudulent login portal. No specific drainer kit or cryptocurrency-related payloads were identified, but the site's structure aligns with credential harvesting tactics commonly used in phishing campaigns.

Technical indicators reveal the domain was registered on March 28, 2026, an anomalous creation date suggesting potential domain spoofing or registry manipulation. It resolves to IP address 43.205.66.122 and is associated with an Amazon-issued SSL certificate. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns a trust score of 0/100. The domain appears on one security blocklist, and AlienVault OTX records it in a single threat intelligence pulse. Google Safe Browsing status is not explicitly noted, but the domain's presence on blocklists confirms its malicious classification.

As of the latest assessment, s-lon.lk has been taken offline, likely due to mitigation efforts by hosting providers or security teams. The domain is blocked by at least one security vendor, reducing immediate exposure risk. However, residual threats remain, including potential reuse of the IP or SSL infrastructure for future phishing campaigns. Users are advised to verify domain authenticity before entering credentials and monitor for similar impersonation attempts targeting S-lon or related brands.