slon11to[.]net

This domain, slon11to.net, is confirmed as an active phishing site with high-risk indicators. Registered on March 13, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to the IP address 188.114.97.3. Analysis indicates it is flagged by 14 out of 95 security vendors on VirusTotal, while threat intelligence platforms report its presence in 23 distinct pulses, suggesting widespread recognition as malicious. The domain is also blocked by at least two security blocklists, reinforcing its classification as a threat. The page title, 'slon11.to,' does not match the domain name, a common tactic to mislead users or evade detection. The site employs a Let's Encrypt SSL certificate, which provides encryption but does not validate legitimacy, as such certificates are freely available and frequently abused by threat actors. The domain's Gridinsoft trust score of 0/100 further corroborates its malicious nature, though the specific phishing kit or targeted brand remains unidentified. Defenders should treat this domain as an active threat. The infrastructure appears to be designed for credential harvesting, likely targeting generic login portals rather than a specific organization. Given its persistence since March 2026 and continued activity as of July 2026, it is recommended to block resolution at the DNS level and monitor for related domains registered through the same registrar. While the exact payload or lure remains unconfirmed, the volume of detections and blocklist inclusions justify immediate containment measures. No evidence suggests this domain is part of a broader campaign, but defenders should correlate with other domains resolving to 188.114.97.3 for potential patterns.