slash-ap[.]co[.]com

This domain, slash-ap.co.com, is actively flagged as a high-risk credential harvesting phishing site by multiple security sources. Registered on February 21, 2026, through a registrar known for hosting abusive domains, the domain currently resolves to 169.60.151.233, an IP address assigned to a hosting provider in Canada. Analysis indicates the domain lacks an SSL certificate, a common red flag for phishing infrastructure, as legitimate sites typically enforce HTTPS for secure communication. The absence of encryption increases the likelihood of intercepted credentials during transmission, aligning with observed phishing tactics targeting unsuspecting users. Infrastructure analysis reveals the domain uses nameservers associated with nic.co.com, a pattern observed in other phishing campaigns leveraging subdomains under co.com for obfuscation. While the exact brand being impersonated remains unclear, the domain’s structure—specifically the slash-ap prefix—suggests an attempt to mimic a login portal or application interface. Security vendors have detected malicious activity, with 15 out of 95 engines on a multi-scanner platform flagging the domain, and it appears on five distinct blocklists, reinforcing its classification as an active threat. Defenders should treat this domain as hostile and prioritize blocking it at the network and endpoint levels. The IP address 169.60.151.233 should be monitored for additional malicious domains, as hosting providers with lax abuse policies often serve as hubs for phishing infrastructure. Given the domain’s registration age and active blocklisting, it is likely part of a broader campaign rather than an isolated incident. Organizations should also inspect logs for connections to this domain, particularly from users who may have interacted with it prior to blocklisting. No legitimate use case has been identified, and the domain’s infrastructure aligns with known phishing patterns.