slon5-to[.]com

The domain slon5-to.com is currently classified as a generic_phishing threat with a high risk rating. Created on February 27, 2026, the domain remains active as of the report date, July 12, 2026, and has been flagged by multiple security entities. Its presence on a security blocklist and active status indicate ongoing malicious use.

Infrastructure analysis shows that slon5-to.com resolves to the IP address 172.67.223.94, hosted within the United States under AS13335 Cloudflare, Inc. The domain is registered through NiceNIC International Group Co., Limited and utilizes Cloudflare nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com. The TLS certificate presented is issued by Let’s Encrypt (E7), and HTTP requests receive a 301 redirect response, suggesting a possible attempt to steer victims to a malicious landing page.

Detection metrics reinforce the threat assessment: the domain appears on one security blocklist and is blocked by PhishDestroy. VirusTotal reports that 4 out of 95 security vendors have flagged the domain, and Gridinsoft assigns a trust score of 0 out of 100, reflecting a lack of confidence in its legitimacy. These indicators collectively corroborate the domain’s malicious intent despite the relatively low number of vendor detections.

Defenders should prioritize immediate blocking of slon5-to.com at network and endpoint layers, enforce DNS filtering, and monitor for any traffic to the associated IP address 172.67.223.94. Continuous observation of the domain’s SSL certificate and HTTP response behavior is advised to detect any changes in infrastructure. Organizations are encouraged to share any observed incidents with threat intelligence platforms to enhance collective visibility of this high‑risk phishing infrastructure.