slon--3[.]cc

This domain, slon--3.cc, is flagged as an active phishing site targeting user credentials through a fake login portal. Registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to 188.114.96.3, a Cloudflare-hosted IP located in Canada. The site returns an HTTP 301 redirect, suggesting it may be funneling victims to another malicious endpoint or preparing for a more sophisticated attack chain. Analysis indicates the domain is still operational as of July 12, 2026, with no confirmed takedown or sinkholing activity. Infrastructure analysis reveals the use of Cloudflare nameservers (dante.ns.cloudflare.com and mckinley.ns.cloudflare.com), a common tactic to obscure hosting details and evade detection. The SSL certificate, issued by Let's Encrypt (serial number E7), is valid and does not raise immediate red flags, though its presence does not guarantee legitimacy. The domain appears on one security blocklist and is detected by 3 out of 95 security vendors on VirusTotal, indicating moderate but not universal recognition as malicious. The page title, 'slon3.cc,' provides no clear impersonation target, leaving the specific brand or service being mimicked uncertain. Defenders should treat this domain as high-risk due to its active status, blocklist presence, and association with credential theft infrastructure. Network-level blocking of 188.114.96.3 and the domain itself is recommended, along with monitoring for related subdomains or redirect chains. The lack of a confirmed impersonation target suggests this may be part of a broader, opportunistic campaign rather than a targeted attack. Security teams should correlate this domain with other indicators, such as email headers or payload delivery mechanisms, to identify potential entry vectors. Given the domain's recent registration and Cloudflare obfuscation, further investigation into its hosting provider and registrar may reveal additional linked infrastructure.