slon3[.]at

This domain is flagged for brand impersonation of Cloudflare and is currently active on the internet. Analysis of the domain slon3.at shows it was created on March 28, 2026, and resolves to IP address 188.114.97.3, which is located in Canada and associated with Cloudflare infrastructure. The domain uses an SSL certificate issued by Let's Encrypt (E7). The page title observed is 'Suspected Misleading Website | Cloudflare', indicating the site itself may be presenting a security warning. Ten out of 94 security vendors on VirusTotal flag this domain as malicious, and it appears on one security blocklist. AlienVault OTX includes this domain in one threat intelligence pulse. The domain is blocked by PhishDestroy. While the exact content of the site has not been visually analysed, the combination of brand impersonation, security vendor detections, and blocklist presence strongly suggests this domain is part of a phishing campaign targeting Cloudflare users. Defenders should block access to this domain at the network level and monitor for related domains or IP addresses. Users who encounter this domain should avoid interacting with it and report it to their security team.