# PhishDestroy domain threat record: slon20.cc Content language: English Canonical HTML report: https://phishdestroy.io/domain/slon20.cc/ Machine-readable companion: https://phishdestroy.io/domain/slon20.cc/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-27 17:01:47 UTC - Last availability or vendor check: 2026-10-28 00:30:51 UTC - Stored record updated: 2026-10-28 00:30:51 UTC - VirusTotal detections in the stored snapshot: 5/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.22.148 - Registrar in stored WHOIS data: Key-Systems GmbH - Registrar country in stored WHOIS data: CY - Last stored HTTP status: 301 - Registration date in stored WHOIS data: 2026-02-11 14:09:33 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a17e4d-bc2c-71c8-a2c7-c2e961be6a50/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/slon20.cc - Certificate Transparency search: https://crt.sh/?q=%25.slon20.cc - Web Archive lookup: https://web.archive.org/web/*/https://slon20.cc/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy lists slon20.cc as suspicious based on vendor detections and observed redirect behavior. The domain was first seen by PhishDestroy on 2026-10-27. An HTTP request on that date returned a 301 redirect to slon6.at, which then redirected to encounter.slon6.at and finally back to slon20.cc with a 403 response. How the scam works The listing reflects a generic redirect‑chaining risk where short or newly registered domains are used to hide a final landing page that could harvest credentials or personal data. No specific phishing form, wallet request, or malware was observed on the captured pages. Evidence VirusTotal scanned the domain on 2026-10-24 and reported five detections: four malicious (BitDefender, ESET, Forcepoint ThreatSeeker, G-Data) and one suspicious (alphaMountain.ai). Google Safe Browsing checked on 2026-10-27 and did not flag the domain. OTX recorded two pulses referencing the domain as of 2026-10-27. PhishDestroy’s internal blocklist includes slon20.cc, while external blocklists showed zero entries on the same day. urlscan captured the redirect chain on 2026-10-27, ending with a 403 status and a non‑malicious engine verdict with a score of –47. Cloudflare Radar scanned the same chain on 2026-10-27 and returned a malicious phishing verdict. Infrastructure The domain was registered with Key-Systems GmbH on 2026-02-11. DNS is served by Cloudflare nameservers and resolves to IPv4 addresses 172.67.205.86 and 104.21.22.148 and IPv6 addresses 2606:4700:3033::ac43:cd56 and 2606:4700:3030::6815:1694. TLS checks found a Let’s Encrypt certificate for *.slon6.at (valid 2026-10-16 to 2027-01-14) and a DigiCert certificate for slon20.cc (valid to 2026-12-05); DNSSEC was not enabled. Cloudflare’s WAF is present on the domain. What to do Visitors should avoid entering any credentials or personal information on pages reached through slon20.cc and, if they have already done so, change affected passwords and monitor accounts for suspicious activity. Security teams can block the domain at firewalls or proxies, add it to threat‑intel feeds, and review web logs for requests to slon20.cc or its redirect targets. No wallet‑related remediation is required because no wallet interaction was observed. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a17e4d-bc2c-71c8-a2c7-c2e961be6a50/ Cloudflare Radar report: https://radar.cloudflare.com/scan/0e294918-b3df-4384-b1da-41aef5dcb303 Stored capture screenshot: https://urlscan.io/screenshots/01a17e4d-bc2c-71c8-a2c7-c2e961be6a50.png Cloudflare Radar screenshot (2026-10-27T17:34:09Z): https://screenshots.phishdestroy.io/cf/0e294918-b3df-4384-b1da-41aef5dcb303.png VirusTotal report: https://www.virustotal.com/gui/domain/slon20.cc Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=slon20.cc Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-27 17:35:13 UTC ## Stored page captures - Primary capture: https://urlscan.io/screenshots/01a17e4d-bc2c-71c8-a2c7-c2e961be6a50.png Captured: 2026-10-27 17:01:47 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a17e4d-bc2c-71c8-a2c7-c2e961be6a50.png Captured: 2026-10-27 17:01:47 UTC Source report: https://urlscan.io/result/01a17e4d-bc2c-71c8-a2c7-c2e961be6a50/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/0e294918-b3df-4384-b1da-41aef5dcb303.png Captured: 2026-10-27 17:34:09 UTC Source report: https://radar.cloudflare.com/scan/0e294918-b3df-4384-b1da-41aef5dcb303 SHA-256: b618af46984286ffcea3a85bea77780a159c8fd79d9ed65d128861f3be25f33e - URLQuery: https://screenshots.phishdestroy.io/uq/f7d2e1b1-c841-4d9c-861c-0a078675a53d.png Source report: https://urlquery.net/report/f7d2e1b1-c841-4d9c-861c-0a078675a53d SHA-256: 686a5210ecfc4c5eab472f59a452404adb15dc4abc519847fa55707065355a44 ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-27T17:12:33Z", "uuid": "01a17e4d-bc2c-71c8-a2c7-c2e961be6a50", "scanned_at": "2026-10-27T17:00:03Z", "final_url": "https://encounter.slon6.at/", "status": 403, "redirected": "off-domain", "redirects": [ { "to": "https://slon6.at/", "from": "https://slon20.cc/", "status": 301 }, { "to": "https://encounter.slon6.at/", "from": "https://slon6.at/", "status": 307 }, { "to": "https://slon20.cc/", "from": "https://encounter.slon6.at/", "status": 307 }, { "to": "https://slon6.at/", "from": "https://slon20.cc/", "status": 301 }, { "to": "https://encounter.slon6.at/", "from": "https://slon6.at/", "status": 307 } ], "ip": "104.26.2.20", "domains": [ "slon6.at", "slon20.cc", "challenges.cloudflare.com" ], "ips": [ "104.18.94.41", "104.26.2.20", "43.159.99.77", "104.21.22.148" ], "asns": [ "13335", "139341" ], "countries": [ "SG" ], "link_domains": [ "www.cloudflare.com" ], "doc_hash": "4febd2f37449f9effda058173a602b28ef527317c322ee0091d96bc6658105ed", "script_hashes": [ "6b79ef333a1a2fb80a4241b6120ec7e5c22d85968f112d8f9c1bd82e50aec0af" ], "globals": [ "_cf_chl_opt", "armBH3", "YDta0", "yCpNJ2", "YMwdw2", "Kncsd9", "vJjAu8", "AhhG9", "JwCUQ7", "fXaz8", "ENLzH2", "Vnlyd3", "GsfY1", "Ewgxh3", "uOdMb2", "qwQRi7", "sSEGO7", "eJeI1", "qgcO0", "xNxMK4", "pRxjE3", "wsqXE7", "sSkll6", "iqzpL9", "nYPYj0", "ZahLT8", "Tlvt6", "KryNx3", "ygHP1", "BWRSl4", "angular", "hbRVt7", "TRcGA3", "DIkC7", "turnstile", "txLfi5" ], "cookies": [ "sid" ], "tls": { "san": [ "*.slon6.at", "slon6.at" ], "cipher": "AES_128_GCM", "issuer": "YE1", "subject": "slon6.at", "protocol": "TLS 1.3", "valid_to": "2027-01-14T09:23:28Z", "valid_from": "2026-10-16T09:23:29Z" }, "domain_age_days": 0, "apex_age_days": 258, "tls_age_days": 11, "tls_valid_days": 89, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": -47, "malicious": false }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "content-security-policy": "default-src 'none'; script-src 'nonce-MzTPOw2y0mHpOHvxKOeAix' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.clou", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),s", "cross-origin-opener-policy": "same-origin", "cross-origin-resource-policy": "same-origin", "cross-origin-embedder-policy": "require-corp" } }, "cf": { "v": 1, "fetched_at": "2026-10-27T17:34:28Z", "uuid": "0e294918-b3df-4384-b1da-41aef5dcb303", "scanned_at": "2026-10-27T17:34:09Z", "final_url": "https://undress.slon6.at/", "status": 403, "redirected": "off-domain", "history": [ { "url": "https://slon20.cc/", "status": 301 }, { "url": "https://slon6.at/", "status": 307 }, { "url": "https://undress.slon6.at/", "status": 403 } ], "dom_hash": "09471bf8e29d5571159827bc83d881c38e2f56d8a5b71911b3689b846bb80841", "doc_hash": "4d4aa0a59e773745c2cb4dcb9e0c1cab911e3a30fd4e64a022c161cf2440ab71", "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "slon6.at", "type": "A", "value": "43.159.98.73" }, { "name": "slon6.at", "type": "A", "value": "43.159.99.77" }, { "name": "undress.slon6.at", "type": "A", "value": "104.26.3.20" }, { "name": "undress.slon6.at", "type": "A", "value": "172.67.71.61" }, { "name": "undress.slon6.at", "type": "A", "value": "104.26.2.20" }, { "name": "undress.slon6.at", "type": "AAAA", "value": "2606:4700:20::681a:214" }, { "name": "undress.slon6.at", "type": "AAAA", "value": "2606:4700:20::681a:314" }, { "name": "undress.slon6.at", "type": "AAAA", "value": "2606:4700:20::ac43:473d" } ], "dnssec_valid": false, "ip": "127.0.1.6", "verdict": { "tags": [ "phishing" ], "malicious": true, "categories": [ "phishing" ] }, "whois": { "created": "2026-02-10T11:49:41Z", "updated": "2026-10-19T20:58:16Z", "nameservers": [ "clara.ns.cloudflare.com", "osmar.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-27T17:33:40Z", "analysis_at": "2026-10-24T01:26:38Z", "stats": { "timeout": 0, "harmless": 52, "malicious": 4, "suspicious": 1, "undetected": 35 }, "detections": { "ESET": "phishing", "G-Data": "phishing", "BitDefender": "phishing", "alphaMountain.ai": "suspicious", "Forcepoint ThreatSeeker": "malicious" }, "reputation": 0, "categories": { "alphaMountain.ai": "Scam/Illegal/Unethical, Suspicious (alphaMountain.ai)" }, "registrar": "Key-Systems GmbH", "created": "2026-02-11T15:09:33Z", "expires": "2028-02-11T15:09:33Z", "updated": "2026-10-12T05:15:16Z", "first_seen": "2026-02-13T23:57:15Z", "dns": [ { "ttl": 14399, "type": "A", "value": "64.190.63.222" }, { "ttl": 21600, "type": "NS", "value": "ns1.sedoparking.com" }, { "ttl": 21600, "type": "SOA", "rname": "hostmaster.sedo.de", "value": "ns1.sedoparking.com" }, { "ttl": 21600, "type": "NS", "value": "ns2.sedoparking.com" }, { "ttl": 3600, "type": "MX", "value": "localhost", "priority": 0 }, { "ttl": 3600, "type": "TXT", "value": "v=spf1 -all" } ], "dns_at": "2026-10-24T02:07:49Z", "jarm": "3fd3fd00000000000043d3fd3fd43d79451d8c63b099acafdbabb24551d0e6", "cert": { "san": [ "slon20.cc" ], "issuer": "DigiCert Inc / Encryption Everywhere DV TLS CA - G2", "serial": "a44faed0115bea5f9ebdda2e8e062e5", "sha256": "9b69173d45252902d3459f246ec05d6c63a3dd4f11003c141b6c3868d789e6ec", "subject": "slon20.cc", "valid_to": "2026-12-05T23:59:59Z", "valid_from": "2026-09-07T00:00:00Z" }, "whois": { "registrar": "Key-Systems GmbH", "registrar_iana_id": "269", "registrar_url": "http://www.key-systems.net", "created": "2026-02-11T15:09:33Z", "updated": "2026-10-12T05:15:16Z", "expires": "2028-02-11T15:09:33Z", "status": [ "ok" ], "nameservers": [ "ns1.sedoparking.com", "ns2.sedoparking.com" ], "dnssec": "unsigned" }, "rdap": { "status": [ "active" ], "events": { "expiration": "2028-02-11T15:09:33Z", "last changed": "2026-10-12T05:15:16Z", "registration": "2026-02-11T15:09:33Z", "registrar expiration": "2028-02-11T15:09:33Z", "last update of RDAP database": "2026-10-24T02:06:59Z" } } }, "webcheck": { "v": 1, "fetched_at": "2026-10-27T17:31:44Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "slon20.cc" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "status": { "up": true, "code": 301, "timings": { "dns": 58, "tls": 33, "wait": 51, "connect": 10, "download": 0 }, "response_ms": 152 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1", "TLSv1.1", "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80, 443, 8080 ] }, "dns_server": { "ns": [ { "ip": "108.162.194.210", "host": "raquel.ns.cloudflare.com" }, { "ip": "172.64.35.77", "host": "razvan.ns.cloudflare.com" } ], "zone": "slon20.cc" }, "location": { "ip": "2606:4700:3033::ac43:cd56", "asn": "13335", "org": "Cloudflare, Inc.", "city": "Toronto", "country": "CA" }, "ssl": { "issuer": "Let's Encrypt / YE2", "subject": "slon20.cc" }, "dns": { "A": [ "172.67.205.86", "104.21.22.148" ], "NS": [ "razvan.ns.cloudflare.com", "raquel.ns.cloudflare.com" ], "SOA": "{\"nsname\": \"raquel.ns.cloudflare.com\", \"hostmaster\": \"dns.cloudflare.com\", \"serial\": 2418607515, \"refresh\": 10000, \"retry\": 2400, \"expire\": 604800, \"minttl\": 1800}", "AAAA": [ "2606:4700:3033::ac43:cd56", "2606:4700:3030::6815:1694" ] }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "message": "Site does not serve any HSTS headers." }, "firewall": { "waf": "Cloudflare", "has_waf": true }, "get_ip": { "ip": "2606:4700:3030::6815:1694", "family": 6 }, "tech_stack": { "technologies": [ "AngularJS", "Cloudflare Turnstile", "Cloudflare" ] }, "whois": { "registrar": "Key-Systems GmbH", "created": "2026-02-11T15:09:33Z", "updated": "2026-10-27T11:45:05Z", "expires": "2028-02-11T15:09:33Z", "status": [ "ok https://icann.org/epp" ], "nameservers": [ "raquel.ns.cloudflare.com", "razvan.ns.cloudflare.com" ] }, "headers": { "headers": { "server": "cloudflare", "content-type": "text/html; charset=UTF-8", "content-security-policy": "default-src 'none'; script-src 'nonce-ZurCJWzyZFyCtIssMjyEMP' 'unsafe-eval' https://challenges.cloudflare.com; script-src-attr 'none'; style-src 'unsafe-inline'; img-src 'self' https://challenges.cloudflare.com; connect-src 'self' https://challenges.cloudflare.com; frame-src 'self' https://challenge", "x-frame-options": "SAMEORIGIN", "x-content-type-options": "nosniff", "referrer-policy": "same-origin", "permissions-policy": "accelerometer=(),camera=(),clipboard-read=(),clipboard-write=(),geolocation=(),gyroscope=(),hid=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=(),xr-spatial-tracking=*", "cross-origin-opener-policy": "same-origin", "cross-origin-resource-policy": "same-origin", "cross-origin-embedder-policy": "require-corp" } } } } ```