slon6z[.]cc

The domain slon6z.cc was observed as part of a generic phishing campaign and is currently offline. Infrastructure analysis shows the hostname resolves to the Cloudflare IP address 188.114.96.3, which is associated with the Cloudflare network in Canada. The domain is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED and uses Cloudflare’s default nameservers (sean.ns.cloudflare.com and suzanne.ns.cloudflare.com). A Let's Encrypt certificate (issued by the YE1 authority) was present at the time of collection, and HTTP requests returned a 403 status code, indicating that the web resource was not publicly accessible when queried. VirusTotal recorded six detections out of ninety‑one scanners, and the domain appears on a single security blocklist. AlienVault OTX cited the domain in two threat‑intel pulses, confirming its inclusion in broader monitoring feeds. The domain has been blocked by the PhishDestroy service. While the exact phishing payload and targeted brand remain unverified, the available indicators suggest active malicious use. Defenders should add the IP address 188.114.96.3 and the domain slon6z.cc to deny‑list rules, monitor for any re‑hosting attempts, and correlate any internal logs that reference the Cloudflare nameservers or the Let's Encrypt certificate fingerprint. Continued observation of the registration details and OTX pulses is recommended to detect potential re‑activation.