slon12at[.]net

On 13 March 2026 the domain slon12at.net was registered through NiceNIC International Group Co., Limited. The site presents the page title “slon12.at” and is served over HTTPS using a Let’s Encrypt certificate (issuer E7) that is currently valid. DNS resolution points to 172.67.165.101, an address owned by AS13335 Cloudflare, Inc., and the domain is delegated to Cloudflare nameservers blair.ns.cloudflare.com and lochlan.ns.cloudflare.com. Traffic analysis shows the presence of Cloudflare Browser Insights and HTTP/3, indicating the use of Cloudflare’s edge services for content delivery and possibly for obfuscation of the true hosting location. Reputation checks flag the domain as high‑risk.

It appears on one security blocklist and is specifically listed by PhishDestroy as a malicious entry. VirusTotal scans returned three positive detections out of ninety‑four antivirus engines, reinforcing the suspicion. Gridinsoft assigns a trust score of 0 / 100, the lowest possible rating. The combination of blocklist presence, multiple vendor detections, and a zero trust score led to the classification of the domain as a generic phishing infrastructure with a high risk rating. The available evidence does not reveal the exact phishing payload, targeted brand, or lure content; the page title is the only visible indicator and no further content analysis has been published.

Consequently, the precise attack vector remains uncertain, but the infrastructure characteristics—newly registered domain, Cloudflare fronting, and multiple security vendor alerts—are consistent with active phishing campaigns. Defenders should proactively block slon12at.net at DNS, proxy, and firewall layers, and add the associated IP address 172.67.165.101 to deny lists, recognizing that the IP is shared among many Cloudflare customers.