salon1[.]cc

Analysis indicates that salon1.cc is an active phishing domain registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. As of July 19, 2026, the domain resolves to 172.67.170.216, a Cloudflare IP located in Canada, and uses Cloudflare nameservers harley.ns.cloudflare.com and walk.ns.cloudflare.com. The domain returns an HTTP 301 redirect, suggesting it is part of a larger redirection chain commonly used in phishing campaigns to obscure the final malicious destination. Defenders should note that the domain is currently flagged by PhishDestroy and appears on at least one security blocklist. Five of 91 security vendors on VirusTotal have detected this domain as malicious, though the exact nature of the phishing content remains unconfirmed due to the lack of detailed page analysis. The SSL certificate is issued by Let's Encrypt (serial E8), which is frequently used by both legitimate and malicious sites. Infrastructure analysis reveals the use of Cloudflare's proxy service, a tactic often employed to mask the true origin of phishing infrastructure. While the domain is classified as a generic phishing threat, no specific brand impersonation or scam type has been verified at this time. Defenders are advised to block traffic to salon1.cc and monitor for related domains using the same nameserver or IP infrastructure.