# PhishDestroy domain threat record: slon12.st Content language: English Canonical HTML report: https://phishdestroy.io/domain/slon12.st/ Machine-readable companion: https://phishdestroy.io/domain/slon12.st/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-09-03 13:35:48 UTC - Last availability or vendor check: 2026-10-21 01:14:27 UTC - Stored record updated: 2026-10-22 14:24:16 UTC - VirusTotal detections in the stored snapshot: 5/89 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 188.114.97.9 - Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND - Last stored HTTP status: 403 - Registration date in stored WHOIS data: 2026-02-11 23:00:00 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a0677d-3217-7519-86ed-accf8d32791e/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/slon12.st - Certificate Transparency search: https://crt.sh/?q=%25.slon12.st - Web Archive lookup: https://web.archive.org/web/*/https://slon12.st/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview slon12.st was an impersonation phishing site that posed as a legitimate service to collect visitors' private information, and crypto users were its likely targets. PhishDestroy first flagged it on 2026-09-03. The site went offline on 2026-09-16, and when we checked again on 2026-10-19 it was still down, with its content blocked by the provider. How the scam works Visitors first saw a page titled "Captcha", a familiar-looking human-verification step. The title shows only a captcha, while we classified the site as impersonation. Schemes like this use a routine check to make the site feel legitimate and to slow down automated scanners, then send the visitor to a lookalike login or connection screen for the brand being copied. Anything typed there, such as passwords, one-time codes, or recovery details, goes straight to the operators, who can use it to take over the account and its funds. Evidence On 2026-09-15, five of 89 VirusTotal engines marked the domain as malicious: alphaMountain.ai, Forcepoint ThreatSeeker, G-Data, SOCRadar and Sophos. That count is modest, but these are independent commercial and threat-intelligence vendors that reached the same verdict on their own. The domain also appears in three AlienVault OTX community pulses and is listed on the PhishDestroy blocklist. It went offline the day after that VirusTotal check. Infrastructure The domain resolved to 188.114.97.9 on Cloudflare's network, with the address placed in Canada. That address belongs to Cloudflare's proxy layer, so it hides the server that actually hosted the phishing content. Its HTTPS certificate came from Google Trust Services (WE1), and a padlock like this is easy to obtain. It shows the connection is encrypted, not that the site is trustworthy. The site stayed active for less than two weeks after we first detected it. What to do If you passed the captcha and entered a username, password or 2FA code, change that password right away on the real service and on any other account that shares it. Then sign out of all active sessions and review your recent logins and security settings. If you typed a wallet recovery phrase, consider that wallet compromised and move any remaining assets to a new wallet created on a clean device. Security teams should block slon12.st at the DNS and proxy level and search their logs for past visits. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a0677d-3217-7519-86ed-accf8d32791e/ VirusTotal report: https://www.virustotal.com/gui/domain/slon12.st Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=slon12.st Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:23:37 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a0677d-3217-7519-86ed-accf8d32791e.png Captured: 2026-09-03 13:35:48 UTC - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/cb20842d-581a-46fe-a8b1-145f58ff118e.png Captured: 2026-09-14 08:40:15 UTC Source report: https://radar.cloudflare.com/scan/cb20842d-581a-46fe-a8b1-145f58ff118e SHA-256: 5b370ad299b352b8002e947fc545cf252021d14b4623cbe54e396b2e84ea97ea ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-21T00:15:36Z", "uuid": "01a0677d-3217-7519-86ed-accf8d32791e", "scanned_at": "2026-09-03T13:37:40Z", "final_url": "https://captcha.zlon14.to/", "status": 200, "redirected": "off-domain", "redirects": [ { "to": "https://zlon14.to/", "from": "https://slon12.st/", "status": 302 }, { "to": "https://zlon14.to/", "from": "https://zlon14.to/", "status": 302 }, { "to": "https://zlon14.to/", "from": "https://zlon14.to/" }, { "to": "https://zlon14.to/", "from": "https://zlon14.to/", "status": 302 }, { "to": "https://captcha.zlon14.to/", "from": "https://zlon14.to/", "status": 302 } ], "ip": "178.20.210.6", "ptr": "undefined.hostname.localhost", "domains": [ "zlon14.to", "slon12.st" ], "ips": [ "178.20.210.6", "188.114.97.3" ], "asns": [ "210006", "13335" ], "countries": [ "DE" ], "doc_hash": "e12797d9522664ebb5ba5da787ce56ff3212a1379c08a497642d0ffefbf27ead", "script_hashes": [ "9fa0fd5b129cc1062500cf31c6be66f6617d829c3e4ccf0dc7cdba46f992632e" ], "cookies": [ "go", "http_refererq2", "tor_scheme_id", "tor_port", "session_id", "session_id_e", "connecting_hash_lite_version", "connecting_hash", "onion_server_id", "session_temp_active" ], "tls": { "san": [ "*.zlon14.to", "zlon14.to" ], "cipher": "AES_128_GCM", "issuer": "YE2", "subject": "zlon14.to", "protocol": "TLS 1.3", "valid_to": "2026-11-25T16:38:44Z", "valid_from": "2026-08-27T16:38:45Z" }, "domain_age_days": 5, "apex_age_days": 9, "tls_age_days": 6, "tls_valid_days": 89, "requests": 11, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 99, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "nginx\nnginx", "content-type": "text/html; charset=UTF-8", "strict-transport-security": "max-age=63072000", "x-frame-options": "SAMEORIGIN\nSAMEORIGIN", "x-content-type-options": "nosniff\nnosniff", "referrer-policy": "strict-origin-when-cross-origin" } }, "cf": { "v": 1, "fetched_at": "2026-10-21T00:26:25Z", "uuid": "cb20842d-581a-46fe-a8b1-145f58ff118e", "scanned_at": "2026-09-14T08:40:15Z", "final_url": "https://captcha.slone16.at/", "status": 200, "redirected": "off-domain", "history": [ { "url": "http://slon12.st/", "status": 307 }, { "url": "https://slon12.st/", "status": 302 }, { "url": "https://slone16.at/", "status": 302 }, { "url": "https://slone16.at/", "status": 200 }, { "url": "https://slone16.at/", "status": 302 }, { "url": "https://slone16.at/", "status": 302 }, { "url": "https://captcha.slone16.at/", "status": 200 } ], "dom_hash": "26134a9af19e26078bb5da466479d133620f5983527369904c12ded94c100e88", "doc_hash": "e35b90deff3cc0b5b802b4f163be502e6fcacc32b560c106d5739c981a799eaa", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "captcha.slone16.at", "type": "A", "value": "193.32.204.11" }, { "name": "captcha.slone16.at", "type": "A", "value": "193.32.204.10" }, { "name": "captcha.slone16.at", "type": "A", "value": "193.32.204.7" }, { "name": "captcha.slone16.at", "type": "A", "value": "193.32.204.9" }, { "name": "slone16.at", "type": "A", "value": "193.32.204.9" }, { "name": "slone16.at", "type": "A", "value": "193.32.204.7" }, { "name": "slone16.at", "type": "A", "value": "193.32.204.10" }, { "name": "slone16.at", "type": "A", "value": "193.32.204.11" } ], "dnssec_valid": false, "ip": "193.32.204.11" }, "vt": { "v": 1, "fetched_at": "2026-10-22T11:58:01Z", "analysis_at": "2026-10-16T15:33:35Z", "stats": { "timeout": 0, "harmless": 55, "malicious": 0, "suspicious": 1, "undetected": 36 }, "detections": { "Gridinsoft": "suspicious" }, "reputation": 0, "registrar": "ST Registry", "created": "2026-02-12T00:00:00Z", "updated": "2026-08-06T00:00:00Z", "first_seen": "2026-06-02T01:41:29Z", "dns": [ { "ttl": 21600, "type": "NS", "value": "casey.ns.cloudflare.com" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "casey.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::6815:5fc6" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3032::ac43:93b1" }, { "ttl": 300, "type": "A", "value": "104.21.95.198" }, { "ttl": 21600, "type": "NS", "value": "josephine.ns.cloudflare.com" }, { "ttl": 300, "type": "A", "value": "172.67.147.177" } ], "dns_at": "2026-10-16T15:46:00Z", "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c", "cert": { "san": [ "slon12.st", "*.slon12.st" ], "issuer": "Google Trust Services / WE1", "serial": "e90e548e51f8cd74136576b6b7df0397", "sha256": "9f3af30dc1492b830785bcee175b3c97852a0cd45d85985abab37baa07c92ffe", "subject": "slon12.st", "valid_to": "2027-01-02T17:16:04Z", "valid_from": "2026-10-04T16:17:31Z" }, "whois": { "registrar": "ST Registry", "created": "2026-02-12T00:00:00Z", "updated": "2026-08-06T00:00:00Z", "nameservers": [ "casey.ns.cloudflare.com", "josephine.ns.cloudflare.com" ] } } } ```