slon5cc[.]net

This domain is flagged as an elevated-risk credential harvesting phishing site targeting users of the legitimate service slon5.cc. Analysis indicates the infrastructure was designed to mimic the authentic platform, likely to deceive visitors into submitting login credentials or other sensitive information under false pretenses. The page title explicitly references "slon5.cc новый сайт," further suggesting an attempt to impersonate the legitimate domain for malicious purposes.

Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited on February 28, 2026, an anomalous future date that may indicate fraudulent registration practices. It resolves to the IP address 188.114.96.3 and is currently offline. The domain appears on one security blocklist and is blocked by PhishDestroy. Its Gridinsoft trust score is 0/100, and VirusTotal reports 1/95 security vendors flagging it as malicious. The SSL certificate is issued by Google Trust Services, and the site employed Cloudflare, Cloudflare Browser Insights, and HTTP/3 technologies, which are commonly abused to obscure malicious activity.

Mitigation steps for this threat include blocking the domain and its resolving IP (188.114.96.3) at the network perimeter. Organizations should monitor for any attempts to access slon5cc.net or related infrastructure and alert users who may have interacted with the domain. Credential resets should be enforced for any accounts that may have been exposed. Additionally, security teams should review logs for connections to the IP address and investigate any anomalous activity linked to the domain’s registration details, including the registrar and SSL certificate issuer.