slun2[.]cc

The domain slun2.cc has been identified as a credential theft phishing site targeting users through deceptive login interfaces. As of the latest assessment, the domain is currently offline, though it remains under active investigation due to its recent operational history. No specific brand impersonation has been confirmed, but the infrastructure aligns with credential harvesting campaigns observed in prior threat clusters. Analysis indicates that slun2.cc resolves to the IP address 172.67.143.200 and utilizes an SSL certificate issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to malicious domains. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk registrations. Despite its recent creation, the domain has evaded widespread detection, with only 0 of 95 VirusTotal vendors flagging it as malicious. Additional threat intelligence sources reveal a Gridinsoft trust score of 0 out of 100, and the domain appears on a single security blocklist, specifically PhishDestroy. AlienVault OTX records indicate its inclusion in one threat intelligence pulse, suggesting limited but existing awareness within the security community. Given the domain’s current offline status, immediate risk to end users is reduced; however, historical patterns suggest potential reactivation or migration to similar infrastructure. Organizations and individuals are advised to monitor network traffic for connections to 172.67.143.200 and implement domain-based blocking for slun2.cc in perimeter security controls. Users should exercise caution with unsolicited login prompts, particularly those redirecting to unfamiliar domains, and verify SSL certificates independently. Security teams are encouraged to correlate logs for prior interactions with this domain and review registrar activity for related high-risk registrations.