slon12at[.]com

This domain, slon12at.com, is flagged as an active generic phishing threat targeting users of the legitimate service slon12.at. Registered on March 13, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to 104.21.85.220, an IP address hosted on Cloudflare's infrastructure (AS13335). Analysis indicates the site employs a 301 HTTP redirect, likely attempting to funnel victims toward a fraudulent login or credential harvesting page. The page title mirrors the legitimate domain, slon12.at, suggesting an intent to deceive users into believing they are interacting with the authentic service. Infrastructure analysis reveals the use of Cloudflare nameservers (blair.ns.cloudflare.com and lochlan.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedown efforts. The domain appears on one security blocklist and is detected by 3 out of 95 security vendors on VirusTotal, with AlienVault OTX listing it in nine threat intelligence pulses. The SSL certificate, issued by Let's Encrypt, provides basic encryption but does not validate the site's legitimacy. While the exact phishing kit or targeted brand remains unconfirmed, the combination of technical indicators strongly suggests malicious intent. Defenders should treat this domain as high-risk and prioritize blocking both the domain and its resolving IP address. Network-level protections, such as DNS filtering or firewall rules, can mitigate exposure. Security teams should also monitor for related domains registered through the same registrar or utilizing similar naming conventions, as these may indicate a broader campaign. Given the domain's recent creation and active status, organizations should assume it remains operational and capable of evolving its tactics. No evidence currently suggests compromise of the legitimate slon12.at service, but users should verify domain authenticity before entering credentials.