slon5[.]info

slon5.info was observed in July 2026 as part of a generic phishing campaign. The domain was registered on 19 March 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently listed as offline. DNS resolution points to 104.21.39.220, an address owned by Cloudflare, Inc. in Canada. Both authoritative name servers, ali.ns.cloudflare.com and zahir.ns.cloudflare.com, belong to Cloudflare, indicating that the operator leveraged Cloudflare’s CDN and security services, including Browser Insights and HTTP/3 support. The site presented a single HTML title “Captcha”, suggesting that the landing page may have been a placeholder or a gate that requires a CAPTCHA challenge before further interaction.

A TLS certificate issued by Let’s Encrypt (E7) was observed, confirming that the site used a valid, publicly trusted certificate at the time of capture. Threat‑intelligence feeds have flagged slon5.info. Four of ninety‑four VirusTotal scanners reported malicious activity, and the domain appears on at least one external blocklist. PhishDestroy has explicitly blocked the domain, reinforcing the assessment that it is being used for phishing. No additional public reputation services or safe‑browsing checks are documented in the supplied data.

The evidence points to a short‑lived infrastructure typical of opportunistic phishing operators: rapid domain registration, reliance on a reputable CDN to hide origin, and a minimal web front‑end that returns a generic captcha title. Because the site is offline, active exploitation cannot be confirmed, but the presence of multiple vendor detections and a blocklist entry indicates a non‑trivial risk. Defenders should continue to deny any network traffic to 104.21.39.220 when associated with slon5.info, add the domain to internal phishing blocklists, and monitor the registrar NICENIC INTERNATIONAL GROUP for any new domains that follow a similar naming pattern.