slon11i[.]cc

The domain slon11i.cc has been identified as an active phishing threat as of July 31, 2026. Registration records show that this domain was created on July 16, 2026, and is registered through Cloudflare, Inc. It is configured with Cloudflare-provided nameservers (ada.ns.cloudflare.com and salvador.ns.cloudflare.com) and resolves to IP address 104.21.12.144. The site is currently active and continues to operate at the time of reporting.

Notably, slon11i.cc appears on one security blocklist, having been specifically blocked by PhishDestroy. This inclusion provides direct evidence that at least one security vendor has confirmed malicious activity associated with the domain. However, wider industry detection is currently limited, as it is not broadly flagged by other public threat intelligence sources based on the available data. The domain has been scanned by 91 security vendors according to VirusTotal; no engines currently detect it as malicious at the time of the latest scan. It is important to emphasize that the absence of detections from other vendors does not constitute evidence of safety, especially given PhishDestroy’s direct block.

There is no evidence available regarding the domain’s specific web content, targeted brands, or phishing kit in use. As such, defenders should prioritize monitoring for this indicator and consider implementing blocks in line with PhishDestroy’s assessment. Continued vigilance is advised as the domain remains operational and under investigation. Security teams should track any additional intelligence updates and validate internal infrastructure exposure to the domain or its resolving IP.