slonl9[.]cc

The domain slonl9.cc is currently classified as a high‑risk generic phishing site and remains active as of July 12, 2026. Registration data shows the domain was created on March 28, 2026 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the Cloudflare‑owned address 188.114.96.3, hosted in Canada, and the domain uses Cloudflare nameservers (dante.ns.cloudflare.com, mckinley.ns.cloudflare.com). An HTTPS endpoint is present, secured by a Let’s Encrypt certificate (issuer E8), which does not mitigate the observed malicious behavior. The site returns an HTTP 301 redirect, and its page title is listed as "slon9.cc". Threat intelligence indicates the domain appears on one security blocklist and is referenced in a single AlienVault OTX pulse. It has been blocked by PhishDestroy and received a Gridinsoft trust score of 0 out of 100. VirusTotal analysis shows three of ninety‑four security vendors flag the domain, reinforcing the phishing designation. Although the exact content of the landing page has not been analyzed, the convergence of blocklist presence, low trust score, and vendor detections provides strong evidence of phishing activity. Defenders should continue to block the domain at network perimeters, monitor DNS queries for the associated IP address, and consider adding the domain to internal threat‑intel feeds. Ongoing observation is advised to detect any changes in hosting or content that could affect detection efficacy.