sweet-bonanza-slot2[.]com

PhishDestroy has opened an active investigation into sweet-bonanza-slot2.com after confirming it is a slot-machine themed phishing lure designed to steal login credentials and financial data from unsuspecting players. The page mimics a popular online slot game portal but is hosted on infrastructure controlled by the threat actor, making every submitted username and password a direct feed into the attacker’s collection system. Because the lure impersonates a legitimate game, victims are especially likely to enter real money account details without suspicion, rapidly converting the stolen credentials into cash withdrawals or further fraud. This domain was flagged on April 02, 2026—only days after creation—by PhishDestroy’s continuous crawlers. VirusTotal currently shows 0/95 antivirus engines detecting the page, reflecting the novelty and low prior reputation of the domain. The site is registered through Fewmoretaps OU (d/b/a Trustname.com) and resolves to IP 104.21.18.213, a shared hosting address already linked to multiple active phishing campaigns. The combination of a brand-new domain, a free Let’s Encrypt certificate, and zero detections places the risk in the early-stage, high-growth phase, with potential for rapid expansion across gaming forums and social media. If you visited sweet-bonanza-slot2.com, assume your credentials were harvested. Immediately change passwords on the real gaming platform and enable two-factor authentication. Run a full antivirus scan, review financial transactions for unauthorized charges, and report the domain to your bank or payment provider. Block the domain at your DNS resolver or firewall to prevent repeat visits, and share this advisory with friends who enjoy online slots.