slon2[.]to

Analysis conducted on July 24, 2026 indicates that the domain slon2.to was registered on March 05, 2026 through the Government of the Kingdom of Tonga. The domain resolves to 172.67.74.208, an IP address owned by AS13335 Cloudflare, Inc., placing the host in the United States. The site is protected by Cloudflare's CDN and presents a TLS certificate issued by Let’s Encrypt (E7). An HTTP request to the root URL returns a 403 status code and the page title is reported as “Captcha”, suggesting that the site is not serving typical content.

VirusTotal records three detections out of ninety‑four scanning engines, confirming that at least a subset of security vendors flag the domain as malicious. Gridinsoft assigns a trust score of 1 out of 100, the lowest possible rating. The domain appears on a single blocklist and is explicitly blocked by PhishDestroy, indicating that threat‑intelligence feeds have identified it as a phishing vector. The nameservers listed are ganz.ns.cloudflare.com and naomi.ns.cloudflare.com, both belonging to Cloudflare.

No additional public threat‑intel sources such as OTX or Safe Browsing entries were referenced in the supplied data. Given the combination of low trust score, vendor detections, blocklist presence, and the 403 response with a “Captcha” title, the infrastructure is consistent with a generic phishing operation that has been taken offline. Defensive actions should include adding slon2.to to deny‑list rules, monitoring for any future re‑registration, and ensuring that inbound traffic from the associated Cloudflare IP range is scrutinized. Organizations should also verify that any internal phishing‑filtering solutions are updated to reflect the current blocklist status.