slon-cnc[.]sk

Analysis indicates that slon-cnc.sk is an active phishing infrastructure observed as of 12 July 2026. The domain resolves to IP 86.110.243.205, hosted in Slovakia under VNET a.s. The web server returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (E8), confirming active HTTPS service. MX records point to mx4.webhouse.sk and mx5.webhouse.sk, both with priority 10, suggesting reliance on the registrar’s mail infrastructure. The domain was registered on 28 March 2026 through WebHouse, s.r.o., and has been listed on a single security blocklist. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, and the site is currently blocked by PhishDestroy. VirusTotal scans show 3 of 94 security vendors flagging the domain, while AlienVault OTX includes it in one threat‑intel pulse. These indicators collectively support a high‑risk classification for generic phishing. Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms employed, as no page content analysis is available. Defenders should add the domain and its IP to block lists, monitor MX traffic for suspicious outbound mail, and enforce TLS inspection to capture any credential submissions. Continuous re‑scanning on multi‑engine platforms is advised to detect any changes in detection ratios.