slon4at[.]net

slon4at.net, a domain previously flagged as malicious by 7 out of 94 vendors on VirusTotal, is now offline. Despite its current status, the domain's past activity indicates it was involved in phishing operations. Hosted by Cloudflare, Inc., the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and had an SSL certificate issued by Let's Encrypt.

The domain was first created on March 28, 2026, suggesting it was a future registration, which might indicate a clerical error or a placeholder for future malicious activities. The page title, "slon4.cc", does not directly correspond to any known brand, pointing to a generic phishing operation rather than targeting a specific company or service.

slon4at.net's presence on one public blocklist, specifically PhishDestroy's, further confirms its malicious nature. Although the domain is currently offline, its previous detection by multiple security vendors highlights the potential threat it posed during its active period. The use of Cloudflare's infrastructure and Let's Encrypt for SSL certification is common among phishing domains, as these services provide anonymity and encryption, making it harder for victims and investigators to trace the source of the attack.