at-slon3[.]cc

Analysis of at-slon3.cc indicates a high-risk phishing domain registered on March 12, 2026, and still active as of July 12, 2026. The domain resolves to IP address 172.67.167.95, hosted behind Cloudflare infrastructure, which is commonly observed in phishing campaigns to obscure origin servers and evade takedowns. Technologies detected include Cloudflare, Cloudflare Browser Insights, and HTTP/3, consistent with modern phishing sites aiming to appear legitimate and load quickly. The domain has been flagged in 23 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. The domain’s trust score is 0/100, reinforcing its classification as malicious. While the page title is listed as 'slon3.cc', no specific brand impersonation or scam type has been confirmed through available indicators. The exact content or target (e.g., financial, corporate login, social media) remains unanalysed, though the domain’s structure and infrastructure are consistent with credential-harvesting operations. Defenders should treat at-slon3.cc as active and malicious. Block the domain and its resolving IP at perimeter security controls. Monitor for connections to 172.67.167.95, particularly from internal networks, as this may indicate compromised endpoints or ongoing phishing attempts. If internal users report exposure, initiate credential rotation and review authentication logs for unauthorized access. The domain’s use of Let’s Encrypt SSL certificates does not indicate legitimacy, as these are frequently abused in phishing campaigns to bypass browser warnings.