slon13to[.]net

The domain slon13to.net was registered on March 13, 2026 through NiceNIC International Group Co., Limited. Automated analysis classifies the site as a generic phishing page, and the current status is active as of July 12, 2026. The page title returned by the web server is “slon13.to”, and the HTTP response code is 520, indicating an unexpected condition from the origin server. Infrastructure inspection shows the domain resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. Both authoritative name servers are Cloudflare-managed (blair.ns.cloudflare.com and lochlan.ns.cloudflare.com), and the site presents a valid Let’s Encrypt certificate signed by the E8 intermediate. The same certificate is observed on other recent malicious registrations, suggesting a shared hosting pattern. Threat intelligence sources reinforce the phishing assessment. AlienVault OTX lists the domain in nine separate pulses, and it appears on one security blocklist. VirusTotal scans have flagged the domain by three out of ninety‑five security vendors, while Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent. PhishDestroy has already blocked the domain, confirming active abuse. Defenders should treat slon13to.net as a high‑risk phishing indicator. Network perimeter controls ought to block outbound connections to the IP 188.114.97.3 and to the domain itself. Email security gateways should add the domain to block lists and enable URL reputation checks. Continuous monitoring of Cloudflare‑hosted IP ranges for similar patterns is advised, and any credential capture attempts linked to the site should be investigated promptly.