slon3cc[.]vip

PhishDestroy identifies slon3cc.vip as an active credential-harvesting domain currently under investigation for generic phishing activity against social media users. The domain is not flagged by VirusTotal endpoints, with 0 detections out of 95 scans as of the latest analysis. This unclassified threat poses significant risk to unsuspecting visitors due to its active status and recent domain registration. slon3cc.vip was registered on April 16, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED. The domain resolves to IP address 64.7.198.31 and operates with a valid Let's Encrypt SSL certificate, increasing its perceived legitimacy. No blocklist entries or trust score data are currently available for this domain, leaving users vulnerable to undetected exploitation. The absence of VirusTotal detections (2/95) suggests this threat remains under the radar despite active operations. While technical analysis continues, users should immediately block slon3cc.vip and avoid all links associated with this domain. Security teams should flag this IP (64.7.198.31) and monitor for related infrastructure. Immediate reporting to domain registrars and cybersecurity platforms is recommended to prevent further victimization. Given the domain's recent creation and active status, proactive blocking is critical to mitigate potential credential theft campaigns.