slon2[.]cc

PhishDestroy identifies slon2.cc as an active credential-phishing domain operating under an elevated threat classification. The domain mirrors branding consistent with the slon3.cc family, indicating a coordinated campaign targeting user credentials under the guise of a legitimate login portal. No specific drainer kit fingerprint has been isolated, though the page title and domain alignment suggest a clone-and-hijack strategy common in credential harvesting operations.

This domain resolves to IP 104.26.1.79 and was registered on February 11, 2026 via Web Commerce Communications Limited dba WebNic.cc. A Let's Encrypt SSL certificate is in use, and VirusTotal analysis shows 10 out of 95 security vendors flagged slon2.cc as malicious. The domain has not yet been processed by Google Safe Browsing (GSB), and public blocklist records indicate no prior detections, demonstrating a recently deployed infrastructure.

Currently active, slon2.cc remains unblocked across major browsers and security platforms. Immediate containment actions include network-level blocking via firewall rules targeting 104.26.1.79 and domain denial within DNS sinkholes. Users are advised to avoid accessing this domain and verify all login URLs manually. Despite these measures, the risk remains elevated due to the domain's youth and untracked status, necessitating heightened monitoring and user awareness campaigns.