slon14at[.]net

Analysis of the domain slon14at.net indicates active brand impersonation targeting the Kraken cryptocurrency exchange. The domain was registered on March 13, 2026, through NiceNIC International Group Co., Limited, and remains operational as of July 12, 2026. Infrastructure analysis reveals resolution to the IP address 104.21.75.201, with Cloudflare services detected, including Cloudflare Browser Insights and HTTP/3 support. The SSL certificate is issued by Google Trust Services, a common feature in phishing campaigns to lend superficial legitimacy. The domain appears on two security blocklists and has been documented in 23 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition as malicious. Detection engines on VirusTotal flag the domain as suspicious, with 13 of 95 security vendors identifying it as harmful. The page title, 'slon14.at,' does not directly reference the targeted brand but aligns with the domain's naming convention, which may be designed to evade casual scrutiny. Defenders should prioritize blocking or monitoring traffic to this domain, particularly in environments where Kraken-related services are accessed. The domain's trust score of 0/100 further corroborates its classification as high-risk. While the exact content of the phishing page has not been analyzed, the combination of brand impersonation, active blocklist presence, and detection by multiple security vendors confirms its malicious intent. No evidence suggests the use of a known phishing kit, and additional forensic analysis would be required to determine the full scope of the campaign.