slon8[.]nz

slon8.nz was registered on June 13 2026 and is currently resolving to the IPv4 address 164.215.103.13. The domain appears on three public security blocklists and has been actively blocked by the PhishDestroy, MetaMask, and SEAL filtering services. VirusTotal’s recent scan shows that seven out of ninety‑one scanning engines returned a malicious classification, reinforcing the elevated risk rating assigned to the domain.

The threat is catalogued as generic phishing, and the domain is marked as active in the intelligence feed. No additional metadata such as SSL certificate details, HTTP response codes, or page title information has been published at this time, so the precise content served by the site remains unknown. The convergence of multiple independent blocklists, a non‑trivial detection rate on VirusTotal, and the presence of the domain on specialized anti‑phishing filters suggests that the infrastructure is being used to host credential‑harvesting or other deceptive pages.

Defenders should continue to deny network connections to 164.215.103.13, update local and cloud‑based URL filtering policies to include slon8.nz, and monitor for any emerging indicators that may reveal the underlying phishing kit or targeted brand. Ongoing collection of HTTP headers, TLS handshake data, and page content is recommended to refine the attribution and to support potential takedown actions.