slon5[.]ltd

PhishDestroy identifies slon5.ltd as an active generic phishing domain under investigation targeting unsuspecting users. The domain lacks association with a specific brand and utilizes a generic draineur kit likely designed to harvest credentials or financial data. Infrastructure includes a Let's Encrypt SSL certificate, suggesting an attempt to appear legitimate. This campaign shows signs of opportunistic targeting rather than focused brand impersonation.

Technical indicators confirm elevated risk: the domain resolves to IP 64.7.198.31 and exhibits 5/95 detections on VirusTotal as of seed 6135d8. Registrar details remain unconfirmed, but creation date appears recent with no established reputation. The domain is not yet flagged in Google Safe Browsing (GSB) and remains absent from major blocklists. These factors indicate an early-stage campaign likely leveraging newly registered domains to evade detection.

Current status remains active with no mitigation in place. Immediate actions include network-wide blocking of IP 64.7.198.31 and domain slon5.ltd, alongside user awareness campaigns to prevent interaction. Remaining risk is moderate due to the low detection rate and unproven mitigation coverage. Organizations should prioritize monitoring for derivative domains and IPs within the same ASN.