slon3-to[.]com

This domain, slon3-to.com, is flagged as an active credential-theft phishing site based on infrastructure analysis and confirmed threat intelligence. Registered on February 27, 2026, through NiceNIC International Group Co., Limited, the domain currently resolves to a Cloudflare-hosted IP (172.67.175.59, AS13335) in the United States. A 301 HTTP redirect is present, suggesting automated traffic routing to a secondary endpoint, a common tactic to obscure the final phishing page. The SSL certificate is issued by Let's Encrypt, which, while legitimate, is frequently exploited by threat actors due to its low barrier to acquisition. The domain appears on one security blocklist and is flagged by 3 of 93 security vendors in aggregated scans, indicating moderate but consistent detection. Infrastructure analysis reveals the use of Cloudflare nameservers (dante.ns.cloudflare.com, mckinley.ns.cloudflare.com) and Cloudflare Browser Insights, which may be leveraged to monitor visitor behavior or evade detection. The presence of Yandex.Metrika, a web analytics service, further suggests tracking capabilities, though this is not inherently malicious. The page title, 'slon3.to,' does not correspond to a known brand, and no specific target or phishing kit has been identified in available data. The Gridinsoft trust score of 0/100 reinforces the domain's high-risk classification. Defenders should treat this domain as an active threat. Immediate actions include blocking resolution at the DNS level, monitoring for connections to the associated IP (172.67.175.59), and investigating any internal systems that have interacted with it. The 301 redirect should be traced to identify the final destination, as it may lead to a credential-harvesting page or further obfuscation. Given the domain's recent registration and Cloudflare hosting, additional scrutiny of related infrastructure (e.g., other domains sharing the same IP or nameservers) is recommended to uncover potential campaign linkages.