# PhishDestroy domain threat record: slon13.st

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/slon13.st/
Machine-readable companion: https://phishdestroy.io/domain/slon13.st/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-08-31 09:44:02 UTC
- Last availability or vendor check: 2026-10-21 01:15:11 UTC
- Stored record updated: 2026-10-22 14:24:16 UTC
- VirusTotal detections in the stored snapshot: 6/89
- Independent public blocklist matches in the stored snapshot: 0
- Google Safe Browsing stored result: no stored flag

## Stored classification

- Targeted brand: Cloudflare

## Stored infrastructure

- Observed IP address: 104.21.41.118
- Registrar in stored WHOIS data: REGISTRAR_NOT_FOUND
- Last stored HTTP status: 403
- Registration date in stored WHOIS data: 2026-02-11 23:00:00 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a05739-e9e9-749a-b396-089afec3fca6/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/slon13.st
- Certificate Transparency search: https://crt.sh/?q=%25.slon13.st
- Web Archive lookup: https://web.archive.org/web/*/https://slon13.st/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Stored PhishDestroy analysis

Overview
slon13.st is an impersonation phishing page built around the Cloudflare brand. It aimed at people who trust Cloudflare's look, including site owners who manage domains through the Cloudflare dashboard and ordinary visitors used to Cloudflare check screens. PhishDestroy first flagged it on 2026-08-31. The site went offline on 2026-09-11 and was still dead when last checked on 2026-10-19, with its content blocked by the provider.

How the scam works
Cloudflare impersonation pages usually take one of two forms. One is a copy of the Cloudflare login that captures account credentials. The other is a fake "verify you are human" check that pushes visitors to take extra steps on their own device. A stolen Cloudflare login can hand an attacker control of DNS, traffic routing and security settings for every domain on that account. The page title now reads "Suspected Phishing | Cloudflare", which is Cloudflare's own warning interstitial, while our classification refers to the impersonation content the domain served.

Evidence
Detection by security vendors is limited. On 2026-09-12, 6 of 89 VirusTotal engines flagged the domain: alphaMountain.ai, CRDF, Forcepoint ThreatSeeker, Gridinsoft, SOCRadar and VIPRE. Because most engines did not flag it, a clean result in another scanner should not be read as proof of safety. Four AlienVault OTX threat pulses reference the domain, which shows other researchers have tracked it. The provider's own phishing block on the content supports our classification.

Infrastructure
The domain sits behind Cloudflare's network, resolving to 104.21.41.118 with a Canadian location. The phishing page was therefore served through the same company it imitated, and that same position let Cloudflare replace the content with a warning. The address is a shared Cloudflare edge IP, not a server dedicated to this operation. About eleven days passed between our first detection and the site going offline.

What to do
If you entered Cloudflare credentials on this site, change your Cloudflare password right away and turn on two-factor authentication. Then check the account audit log, API tokens, DNS records and page rules for changes you did not make. If a fake verification prompt led you to run anything on your computer, disconnect it and scan it with up-to-date security software. Change any passwords that were saved on that machine. Defenders should block the slon13.st domain rather than its IP, since blocking a Cloudflare edge address would also cut off unrelated sites. They should also search proxy and DNS logs from 2026-08-31 onward for users who reached it.

Useful links
urlscan.io scan and screenshot: https://urlscan.io/result/01a05739-e9e9-749a-b396-089afec3fca6/
VirusTotal report: https://www.virustotal.com/gui/domain/slon13.st
Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=slon13.st
Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/
Site owner? Request a review: https://phishdestroy.io/appeals/
Analysis generated: 2026-10-19 10:25:04 UTC

## Stored page captures

- Primary capture: https://urlscan.io/screenshots/01a05739-e9e9-749a-b396-089afec3fca6.png
  Captured: 2026-08-31 09:44:02 UTC
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/288f7c43-2ae1-4328-8c49-5bb65c7cf47e.png
  Captured: 2026-09-12 00:00:22 UTC
  Source report: https://radar.cloudflare.com/scan/288f7c43-2ae1-4328-8c49-5bb65c7cf47e
  SHA-256: da76fe6c1c3c4712d3edbc7192c72fb6a021baa8d43b9627dde3bf9ed47e7f9a

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-21T02:21:27Z",
        "uuid": "01a05739-e9e9-749a-b396-089afec3fca6",
        "scanned_at": "2026-08-31T09:50:13Z",
        "final_url": "https://slon13.st/",
        "globals": [
            "ontouchcancel",
            "ontouchend",
            "ontouchmove",
            "ontouchstart",
            "assert",
            "getRequiredElement",
            "P",
            "S",
            "getRandomNum",
            "getTimeStamp",
            "Dimensions",
            "Config$2",
            "getGlobalConfig",
            "setGlobalConfig",
            "Config$1",
            "Config",
            "setMaxGapCoefficient",
            "setMaxObstacleLength",
            "Status",
            "A11yStrings",
            "RunnerClasses",
            "RunnerSounds",
            "RunnerEvents",
            "updateCanvasScaling",
            "getA11yString",
            "vibrate",
            "createCanvas",
            "decodeBase64ToArrayBuffer",
            "createAdjustedCollisionBox",
            "drawCollisionBoxes",
            "boxCompare",
            "toggleHelpBox",
            "diagnoseErrors",
            "portalSignin",
            "updateForDnsProbe",
            "getMainFrameErrorCssClass",
            "getMainFrameErrorIconCssClass",
            "getSubFrameErrorIconCssClass",
            "shouldShowSuggestionsSummaryList",
            "getSuggestionsSummaryItemCssClass"
        ],
        "domain_age_days": 3,
        "apex_age_days": 3,
        "requests": 5,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 88,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-21T02:33:04Z",
        "uuid": "288f7c43-2ae1-4328-8c49-5bb65c7cf47e",
        "scanned_at": "2026-09-12T00:00:22Z",
        "final_url": "https://slon13.st/cdn-cgi/phish-bypass",
        "status": 400,
        "redirected": "https-only",
        "history": [
            {
                "url": "http://slon13.st/",
                "status": 307
            },
            {
                "url": "https://slon13.st/",
                "status": 403
            },
            {
                "url": "https://slon13.st/cdn-cgi/phish-bypass",
                "status": 400
            }
        ],
        "dom_hash": "7fc99aa2d89e0695afe980fa5a4f6850d050e60e0805209b2ab086fa92f20e16",
        "doc_hash": "724cf3189448b86ad2163f0f93d7f86cab7cfe118ed5721004b178d9023e3f0e",
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "slon13.st",
                "type": "A",
                "value": "104.21.41.118"
            },
            {
                "name": "slon13.st",
                "type": "A",
                "value": "172.67.164.191"
            },
            {
                "name": "slon13.st",
                "type": "AAAA",
                "value": "2606:4700:3032::6815:2976"
            },
            {
                "name": "slon13.st",
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:a4bf"
            }
        ],
        "dnssec_valid": false,
        "ip": "104.21.41.118",
        "verdict": {
            "tags": [
                "phishing",
                "phishing_interstitial"
            ],
            "malicious": true,
            "categories": [
                "phishing"
            ]
        },
        "whois": {
            "registrar": "ST Registry",
            "created": "2026-02-12T00:00:00Z",
            "updated": "2026-08-27T00:00:00Z",
            "expires": "2027-02-12T00:00:00Z",
            "nameservers": [
                "collins.ns.cloudflare.com",
                "vern.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-22T17:44:09Z",
        "analysis_at": "2026-10-11T16:31:33Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 4,
            "suspicious": 1,
            "undetected": 34
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "phishing",
            "Gridinsoft": "suspicious",
            "alphaMountain.ai": "phishing",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "categories": {
            "alphaMountain.ai": "Phishing (alphaMountain.ai)"
        },
        "registrar": "ST Registry",
        "created": "2026-02-12T00:00:00Z",
        "updated": "2026-08-27T00:00:00Z",
        "first_seen": "2026-08-09T01:45:29Z",
        "dns": [
            {
                "ttl": 21600,
                "type": "NS",
                "value": "vern.ns.cloudflare.com"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "collins.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3034::ac43:a4bf"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "collins.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.164.191"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.41.118"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3032::6815:2976"
            }
        ],
        "dns_at": "2026-10-11T16:35:55Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "slon13.st",
                "*.slon13.st"
            ],
            "issuer": "Google Trust Services / WE1",
            "serial": "6f18dcde8d8cc00513db1c051ea4ff88",
            "sha256": "0ef20cf1b7e431dd31fe405d05152221906d77a259ead8372afc8de1f6a8c18e",
            "subject": "slon13.st",
            "valid_to": "2026-11-25T16:03:17Z",
            "valid_from": "2026-08-27T15:04:54Z"
        },
        "whois": {
            "registrar": "ST Registry",
            "created": "2026-02-12T00:00:00Z",
            "updated": "2026-08-27T00:00:00Z",
            "nameservers": [
                "collins.ns.cloudflare.com",
                "vern.ns.cloudflare.com"
            ]
        }
    }
}
```