slon9-at[.]com

Analysis of the domain slon9-at.com indicates active credential-harvesting infrastructure impersonating the legitimate service slon9.at. The domain was registered on March 2, 2026, through NiceNIC International Group Co., Limited, and currently resolves to the IP address 104.21.58.236, hosted on Cloudflare's network (AS13335). Nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com further confirm Cloudflare as the underlying provider, a common tactic to obscure hosting origins and evade takedowns. The SSL certificate, issued by Let's Encrypt, suggests automated deployment typical of large-scale phishing operations. Detection data reveals moderate but consistent flagging: 4 of 93 security vendors on VirusTotal classify the domain as malicious, while AlienVault OTX lists it in 23 threat intelligence pulses. Gridinsoft assigns a trust score of 0/100, and PhishDestroy has blocked the domain, though it remains active as of July 12, 2026. The HTTP 301 redirect behavior suggests the domain may serve as an intermediary in a multi-stage phishing chain, though the final destination remains unconfirmed. The page title 'slon9.at' directly mirrors the legitimate domain, indicating a likely attempt to deceive users familiar with that service. No specific phishing kit or brand-specific artifacts have been identified in available intelligence, limiting attribution to a generic credential-harvesting campaign. Defenders should treat this domain as high-risk, particularly in environments where slon9.at is a known service. Monitoring for connections to 104.21.58.236 or domains with similar naming patterns (e.g., [brand]-at.com) is recommended for proactive detection.