slon-1[.]net

slon-1.net has been observed as an active phishing infrastructure since its registration on 27 February 2026. The domain is delegated to Cloudflare’s authoritative name servers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com, indicating the use of Cloudflare’s DNS and CDN services. The registration was performed through NiceNIC International Group Co., Limited, and the domain points to the IP address 188.114.97.3, which belongs to Cloudflare’s AS13335 network located in the United States.

The web service returns an HTTP 301 redirect and serves a TLS certificate issued by Let’s Encrypt (subject identifier E8). The page title presented to browsers is “slon1.cc”, a mismatch that suggests intentional obfuscation or re‑branding of the landing page. Underlying technologies identified include Cloudflare Browser Insights and HTTP/3, confirming that traffic is being proxied through Cloudflare’s edge network. No additional hosting details are exposed beyond the Cloudflare front‑end.

Reputation signals corroborate the malicious intent. VirusTotal scans flagged the domain by 4 of 95 security vendors, and the domain appears on a single public blocklist. Gridinsoft assigns a trust score of 0 out of 100, and PhishDestroy has already blocked the domain. The limited number of detections may reflect the short operational window, but the convergence of low trust scoring, blocklist presence, and redirect behaviour is consistent with a high‑risk phishing campaign.

Defenders should add slon-1.net to network deny lists and configure DNS filtering to return NXDOMAIN or sinkhole responses. Monitoring for additional domains that resolve to the same Cloudflare IP range is advisable, as threat actors often spin up new hostnames on shared infrastructure. Incident response teams should also examine any compromised credentials that may have been harvested through the site, and users should be warned to avoid clicking links that reference the domain or its “slon1.cc” title.