slun5[.]cc

This domain is flagged as a generic phishing threat under active investigation, specializing in credential harvesting through fraudulent login interfaces. Analysis indicates the infrastructure is designed to mimic legitimate authentication portals, potentially targeting users of unspecified platforms to capture sensitive account details. Infrastructure analysis reveals the domain slun5.cc was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.97.3, which has been observed in prior phishing campaigns. The domain currently holds a VirusTotal detection score of 0/95, suggesting evasion of initial automated detection systems. It appears on one security blocklist and was flagged in a single AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Google Trust Services, providing a false sense of legitimacy, while the Gridinsoft trust score remains at 0/100, reinforcing its malicious classification. The page title, slon5.cc, may indicate a typographical error or intentional obfuscation to avoid detection. Mitigation against this threat involves implementing DNS-based blocking of the domain slun5.cc and its associated IP 188.114.97.3 at the network perimeter. Organizations should deploy email filtering rules to quarantine messages containing links to this domain or its subdirectories. End-users should be advised to verify the authenticity of login portals by inspecting the URL and SSL certificate details before entering credentials. Security teams are recommended to monitor for connections to the IP address and domain, as well as to review logs for any prior interactions with this infrastructure. Given the domain's current offline status, continuous monitoring for reactivation is advised.