slon5-to[.]net

Analysis of the domain slon5-to.net indicates confirmed phishing activity with a high-risk classification. Registered on February 27, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to the IP address 188.114.97.3. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3 protocol support, which may be leveraged to obfuscate malicious traffic or evade detection. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains due to its accessibility. The domain is flagged by 4 of 95 security vendors on VirusTotal, a modest detection rate that suggests emerging or evasive phishing tactics. AlienVault OTX records show the domain appearing in 23 threat intelligence pulses, indicating active tracking by security researchers. It is currently listed on two security blocklists and blocked by at least two threat intelligence feeds. The page title, 'slon5.to,' suggests an attempt to impersonate or redirect users from the legitimate slon5.to domain, though the exact nature of the phishing content remains unconfirmed due to lack of direct analysis. Defenders should treat this domain as malicious and prioritize blocking resolutions to 188.114.97.3. Monitoring for related subdomains or newly registered domains under the same registrar may help identify further abuse. Given its recent registration and active status, continued vigilance is recommended, particularly for organizations with ties to the slon5.to brand or user base.