slon5-cc[.]at

This site, slon5-cc.at, posed as a Facebook-branded social media page to impersonate the legitimate platform. The page title promoted the “Kraken” market, indicating the site aimed to direct users toward an anonymous marketplace on the Tor network, likely for illicit transactions. The threat is social media impersonation combined with a phishing or redirect scheme to a darknet marketplace, risking credential theft or further exposure to illegal services.

Technical analysis shows VirusTotal flagged the domain with 8 out of 95 detections from vendors including ADMINUSLabs, alphaMountain.ai, CyRadar, ESET, and Gridinsoft. The domain is registered with Dynadot LLC, hosted on IP 172.67.167.102 in the United States under AS13335 Cloudflare, Inc. Nameservers are amos.ns.cloudflare.com and kay.ns.cloudflare.com. GridinSoft trust score is 0 out of 100, and the DOM risk score is 63.

The site is currently down or offline. Based on the high risk score and multiple vendor detections, the threat level is significant. The impersonation of a major brand like Facebook combined with a darknet marketplace link indicates a clear malicious intent, warranting permanent blocking.