slon14cc[.]com

The domain slon14cc.com was observed in active short‑term investigations as a generic phishing site. The site responds with an HTTP 301 redirect and presents a page titled “slon14.cc”. Its registration date of 13 March 2026 and the presence of a Let’s Encrypt certificate issued to the same domain indicate recent deployment aimed at mimicking legitimate services. Infrastructure analysis shows the domain resolves to 172.67.188.254, an address owned by Cloudflare, Inc. (AS13335). Both authoritative name servers—blair.ns.cloudflare.com and lochlan.ns.cloudflare.com—are Cloudflare‑provided, which obscures the underlying hosting environment and complicates attribution. The SSL certificate is signed by Let’s Encrypt and carries the E8 identifier, confirming a freely issued certificate rather than a compromised or stolen one. Threat‑intel sources reinforce the malicious assessment. AlienVault OTX lists the domain in nine separate pulses, and the blocklist maintained by PhishDestroy flags it as a confirmed phishing vector. Gridinsoft’s trust score of 0 out of 100 reflects a severe lack of reputation. VirusTotal reports that four out of ninety‑five scanners flagged the domain, indicating detection by multiple anti‑malware engines despite a relatively low overall detection rate. Uncertainty remains around the specific credential‑harvesting payload, as the HTTP 301 response masks the final landing page, and no content samples have been publicly released. Analysts should therefore treat any URL pointing to slon14cc.com as malicious, enforce URL filtering, and consider blocking the IP address 172.67.188.254 at the network perimeter. Continuous monitoring of the associated ASN and any newly observed certificates is advised to catch potential re‑hosted copies.