slon1[.]to

Analysis indicates that the domain slon1.to was registered on 2026-03-05 through a registrar identified as the Government of Kingdom of Tonga. The authoritative name servers are ganz.ns.cloudflare.com and naomi.ns.cloudflare.com, and the site is fronted by Cloudflare's network (AS13335). DNS resolution points to IP 172.67.74.208, which is located in the United States. The web server returns an HTTP 301 redirect and presents a TLS certificate issued by Let's Encrypt (E7). The page title returned is “Captcha”, but no further content has been captured. The domain appears in one security blocklist and has a Gridinsoft trust score of 0/100, indicating a high likelihood of malicious use. AlienVault OTX has referenced the domain in 23 separate threat‑intel pulses, and three of ninety‑four VirusTotal scanners have flagged it. PhishDestroy currently blocks the domain. The combination of recent registration, low trust score, presence on blocklists, and multiple threat‑intel references suggests that slon1.to is being used for a phishing campaign. At this time, the specific target or payload details are unknown. Defenders should add the domain and its resolving IP to deny‑list rules, monitor DNS queries for the associated Cloudflare name servers, and enforce outbound filtering to prevent user interaction with the site. Continuous re‑evaluation is advised as additional indicators may emerge.