slon7-at[.]com

Analysis as of July 24, 2026 indicates that the domain slon7-at.com was registered on March 2, 2026 through NiceNIC International Group Co., Limited. The domain resolves to the Cloudflare address 172.67.210.73, which belongs to ASN 13335 operated by Cloudflare, Inc., and the hosting location is listed as the United States. The SSL certificate presented is a Let’s Encrypt certificate issued under the E7 identifier, confirming that the site used standard automated TLS provisioning. The HTTP response code for the site is currently offline, indicating that the content has been taken down or otherwise removed.

The page title reported from previous crawls is "slon7.at", but the content of that page has not been publicly released for analysis. Threat intelligence shows that three of ninety‑three security vendors on VirusTotal flagged the domain, suggesting a modest level of detection across the scanning ecosystem. In addition, the domain appears on a single external blocklist and is specifically listed by the PhishDestroy service, reinforcing the classification of the domain as a phishing vector. No further public categorization or detailed payload description is available, so the exact phishing campaign tactics, target brand, or credential‑harvesting mechanisms remain unknown.

Defenders should continue to block traffic to slon7-at.com at the network perimeter, enforce DNS sinkholing for the domain, and monitor for any residual connections to the associated IP address 172.67.210.73. Given that the domain is hosted behind Cloudflare, any future re‑hosting of malicious content could be obscured by the provider’s CDN, so repeated resolution checks are advisable. Additional scrutiny of the registration details—particularly the use of NiceNIC International Group Co., Limited—may aid in identifying related abuse patterns. Until further evidence emerges, the observed indicators justify an elevated risk posture for the domain.