slon15at[.]net

PhishDestroy has identified slon15at.net as a brand impersonation threat specifically targeting the Kraken cryptocurrency platform. This domain was designed to deceive users into believing they were accessing legitimate Kraken services, potentially leading to credential theft or exposure to crypto drainer mechanisms. The site's page title was found to be 'slon15.at', which closely mimics a legitimate domain, adding to its deceptive appearance.

Technical analysis reveals that slon15at.net was registered on March 13, 2026, through NiceNIC International Group Co., Limited, a registrar often associated with malicious domains. The domain resolves to IP address 104.21.54.34 and is secured with a Let's Encrypt SSL certificate (E8). VirusTotal analysis shows that 3 out of 95 security vendors flagged this domain as malicious, and it appears on 1 security blocklist. Additionally, AlienVault OTX indicates the domain was found in 9 threat intelligence pulses, confirming its association with malicious activity.

As of the latest check, slon15at.net has been taken offline, mitigating immediate risk. However, users should remain vigilant as similar domains may emerge. To stay safe, always verify URLs directly, use browser-based security tools, and avoid clicking on unsolicited links. PhishDestroy continues to monitor for related threats and recommends enabling multi-factor authentication for sensitive accounts.