slon1-at[.]net

On 12 July 2026, the domain slon1-at.net was observed hosting a generic phishing site. The domain was registered on 18 February 2026 through NiceNIC International Group Co., Limited and is hosted on Cloudflare infrastructure (ASN 13335). DNS resolution returns the address 104.21.85.152 and the authoritative nameservers are dante.ns.cloudflare.com and mckinley.ns.cloudflare.com. The site presents an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (issuer E7). The page title returned by the server is "slon1.at". VirusTotal scans show three of ninety‑three vendors flagging the domain, and it appears on one external blocklist (PhishDestroy). The risk level is classified as high and the status remains active. Analysis indicates that the domain’s infrastructure is typical of fast‑flux or abuse‑resistant services, leveraging Cloudflare’s CDN to obscure the origin server. The limited detection count suggests that the payload may be newly deployed or that many scanners have not yet flagged it. Defenders should add slon1-at.net to outbound and inbound filtering rules, ensure DNS sinks are updated, and monitor for any related C2 communications targeting the same IP range. Continuous re‑scanning on VirusTotal or similar platforms is recommended to capture any emerging detections. Because the page content has not been publicly reviewed, the exact phishing template remains unknown, and further investigation is required to determine the credential‑capture mechanisms employed.