slon1-cc[.]com

This domain, slon1-cc.com, is currently flagged as a high-risk generic phishing site. Analysts have observed that the domain impersonates the legitimate site slon1.cc, which could be part of a broader effort to deceive users into divulging sensitive information. The domain was created on February 28, 2026, and has been active since then, indicating a deliberate and ongoing campaign. The domain resolves to the IP address 104.21.30.162, which is located in the United States and is hosted by Cloudflare, Inc. (AS13335). This hosting arrangement suggests that the attackers are leveraging reputable infrastructure to enhance the credibility of their phishing operation and potentially evade detection. The use of a Let's Encrypt SSL certificate (E7) further complicates detection, as it can create a false sense of security for unsuspecting users who may assume the site is legitimate due to the HTTPS protocol. Despite the domain's recent creation, it has already been identified by one security blocklist and marked as dangerous, with a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust in the domain. The HTTP status code 301 indicates that the domain is set up to redirect to another location, which is a common tactic in phishing campaigns to mask the true destination of the user. This redirection behavior, combined with the domain's high-risk status, suggests that it is part of a sophisticated phishing infrastructure designed to capture and misuse user data. Defenders are advised to block access to this domain and to educate users about the dangers of following untrusted links and the importance of verifying the URL before entering any sensitive information. Regular monitoring of network traffic and user activity can help in early detection and mitigation of potential threats associated with this domain.