slon3-to[.]net

slon3-to.net was registered on February 27, 2026 through NiceNIC International Group Co., Limited and currently serves a TLS certificate issued by Let’s Encrypt (identifier E8). The site returns an HTTP 301 redirect and presents the page title “slon5.to”, suggesting an attempt to masquerade as a similarly named service. The domain remains active as of the report date, July 12 2026. Infrastructure analysis shows the domain resolves to the IP address 172.67.179.11, which belongs to AS13335 Cloudflare, Inc. in the United States. Both authoritative name servers, dante.ns.cloudflare.com and mckinley.ns.cloudflare.com, are hosted on Cloudflare’s network, and the site leverages Cloudflare Browser Insights, Cloudflare services, and HTTP/3. The presence of a legitimate Let’s Encrypt certificate does not mitigate the malicious intent, as it only provides encrypted transport. Detection telemetry indicates that 4 of 95 security vendors on VirusTotal flag the domain as malicious, and Gridinsoft assigns a trust score of 0 out of 100. The domain appears on a single external blocklist and is listed as blocked by PhishDestroy. The risk level is assessed as high, and the status is marked active, consistent with ongoing phishing campaigns that employ short‑lived domains hosted behind major CDNs. Defenders should add slon3-to.net to URL filtering rules and block the associated IP 172.67.179.11 at the network perimeter. Continuous monitoring of Cloudflare‑hosted domains with low trust scores is advised, as the same infrastructure is frequently reused for new campaigns. End‑user awareness training should emphasize the mismatch between the domain name and the displayed page title, which is a common indicator of credential‑harvesting sites.