slon1at-a[.]org

PhishDestroy identifies slon1at-a.org as an active generic phishing domain registered on February 24, 2026. No weaponized brand was observed at intake, but the page is designed to harvest crypto credentials and initiate drainer scripts. Technical indicators include a Let’s Encrypt SSL certificate and hosting on 198.251.84.254 via Cloudflare, consistent with evasive hosting patterns favored by today’s phishing kits. The domain remains unblocked in Google Safe Browsing and was only flagged internally, placing end users at risk of immediate credential theft and wallet draining.

This domain was flagged with a 11/95 VirusTotal detection ratio, meaning none of the 95 participating engines could identify the payload at the time of scanning. The registrar is Cloudflare, Inc., which obscures underlying registrant details and enables rapid infrastructure cycling. The IP address 198.251.84.254 hosts multiple low-reputation domains and has zero Safe Browsing listings, while the certificate was issued only days after domain creation, a common tactic to appear benign. These exact indicators are cataloged under seed f6e30a to prevent hash-collision obfuscation.

Current status is under investigation; the payload remains live and accessible. Recommended actions include immediate network egress blocking for 198.251.84.254, blacklisting the domain via DNS sinkholing, and submitting the URL to browser-phishing feeds for global deprecation. Remaining risk is high: the drainer kit is operational, SSL is valid, and the campaign can scale rapidly using Cloudflare’s free-tier infrastructure. End users should avoid interaction and report any exposures to their security teams for incident response.