app[.]sliofinance[.]com

Analysis as of July 24 2026 indicates that the subdomain app.sliofinance.com was registered on February 22 2026 through NiceNIC International Group Co., Limited. DNS resolution points to 172.67.150.14, an address owned by Cloudflare, Inc. (AS13335) and located in the United States. The domain is served by Cloudflare’s default authoritative name servers rosa.ns.cloudflare.com and will.ns.cloudflare.com. No TLS certificate was observed for the host, and an HTTP request returned a 404 Not Found page title, suggesting that the site is not serving legitimate content at the time of testing. The domain appears on a single security blocklist and has been explicitly blocked by PhishDestroy.

VirusTotal scans reported that two of ninety‑five AV engines flagged the domain, providing modest but corroborating evidence of malicious intent. The current status is listed as offline, limiting immediate observation of payloads or phishing pages that may have been hosted previously. The available evidence confirms that app.sliofinance.com was used in a generic phishing operation, likely intended to lure victims under the guise of a financial service. However, because the site is presently offline and returns a generic 404 response, the exact phishing template, credential‑harvesting method, and targeted audience remain unknown. The lack of an SSL certificate further suggests a hastily deployed infrastructure, while reliance on Cloudflare’s network may have been intended to obscure the true origin of the malicious server.

Defenders should continue to block the domain and its associated IP address at perimeter firewalls and DNS filtering solutions. Adding the domain to internal blocklists and monitoring for any re‑registration or changes in DNS resolution is advisable. Given the modest detection rate on VirusTotal, correlation with other threat‑intel feeds may uncover additional indicators of compromise. Continuous observation of Cloudflare‑associated IP ranges, especially 172.67.150.