slon9at[.]net

On 22 July 2026 the domain slon9at.net was observed hosting a site with the title “КРАКЕН”. The domain was registered on 28 February 2026 through NiceNIC International Group Co., Limited and resolves to the Cloudflare IP address 104.21.14.72, which belongs to AS13335 (Cloudflare, Inc.) located in the United States. DNS resolution is delegated to the Cloudflare authoritative name servers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com. The web server presents a valid Let’s Encrypt certificate (issued by the E7 intermediate) and returns an HTTP 301 redirect for the initial request, suggesting a possible attempt to steer victims to a secondary URL.

The site appears on at least one security blocklist and has been flagged by PhishDestroy. VirusTotal analysis shows that 2 of 93 scanned security vendors flagged the domain as malicious, indicating limited but non‑zero detection consensus. No additional public intelligence such as OTX entries, Safe Browsing signals, or detailed payload samples have been released for this host. The combination of a newly created domain, Cloudflare hosting, a redirect response, and a Russian‑language page title raises suspicion that the site may be used for credential‑harvesting or other phishing‑related activities, though the specific target or campaign details remain unknown.

Defenders should add slon9at.net to blocklists, monitor DNS queries for this domain, and enforce web‑filtering policies to prevent user access. Incident response teams should consider inspecting any outbound connections from internal hosts to the IP 104.21.14.72 and, where feasible, capture HTTP traffic to determine the final landing page after the redirect. Because the domain is still active, continuous re‑evaluation of detection scores is recommended.