slon-3[.]net

The domain slon-3.net was registered on February 27 2026 through NiceNIC International Group Co., Limited and currently resolves to the IP address 188.114.97.3. The host returns an HTTP 301 status and serves a TLS certificate issued by Let’s Encrypt (E8). Both authoritative nameservers, dante.ns.cloudflare.com and mckinley.ns.cloudflare.com, belong to Cloudflare’s AS13335 network, placing the server in the United States. Network analysis shows the address is hosted behind Cloudflare, with Cloudflare Browser Insights and HTTP/3 observed in the traffic fingerprint. The domain appears on a single public blocklist, PhishDestroy, and VirusTotal reports four detections out of ninety‑five scanned security vendors. The page title returned by the HTTP response is “slon3.cc”, which differs from the registered hostname, indicating a possible redirection or content cloaking technique. The available intelligence classifies the site as a generic phishing operation and assigns a high risk rating. While the limited blocklist presence and modest VirusTotal detection count suggest a relatively new infrastructure, the use of a reputable CDN and a valid TLS certificate may help the actors evade basic network controls. No additional payload, credential‑stealing page, or targeted brand information has been observed, leaving the exact phishing lure and victim profile uncertain. Defenders should block DNS resolution for slon-3.net and monitor traffic to its Cloudflare‑hosted IP 188.114.97.3. HTTPS inspection rules should be updated to flag the “slon3.cc” page title and the 301 redirect pattern. Continuous re‑evaluation of VirusTotal and blocklist entries is advised, as additional detections may emerge. Organizations using automated phishing protection should incorporate the domain and its associated IP into their deny lists to mitigate potential credential harvesting attempts.