slon2[.]at

slon2.at was registered on March 28, 2026 and remains active as of July 12, 2026. The domain is classified as a generic phishing site and carries a high risk rating. Its short lifespan and recent creation are consistent with fast‑flux phishing infrastructure that aims to evade early detection. Infrastructure analysis shows the domain resolves to the IP address 104.26.15.155, which is hosted in Canada and is part of a content delivery network. The web server presents a Let’s Encrypt certificate signed with the E8 algorithm, and an HTTP request returns a 403 status code, indicating that direct content retrieval is blocked or restricted. Threat‑intel sources have flagged the domain on a single phishing blocklist and it appears in one threat intelligence pulse. Reputation scoring from Gridinsoft assigns a trust score of 1 out of 100, reflecting extreme suspicion. VirusTotal reports that 14 out of 95 scanned security vendors have raised detections against the domain, reinforcing the phishing classification. Uncertainty remains regarding the specific payload or credential‑harvesting pages hidden behind the 403 response, as no content was captured. Defenders should block DNS resolution for slon2.at, enforce outbound filtering to the associated IP, and monitor for any HTTP POST activity targeting the domain. Continuous re‑evaluation is advised, as the threat actor may shift hosting or modify the certificate.