slon7[.]cl

On 29 July 2026, security monitoring systems identified the domain slon7.cl as part of an active generic phishing campaign. The domain is currently classified with an elevated risk level and has a unique seed identifier d71fb7. VirusTotal analysis shows that four out of ninety‑one participating security vendors have flagged the domain, indicating that at least a subset of AV engines recognize malicious behavior associated with the host. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy mitigation service, confirming that known defensive platforms consider it hostile.

Publicly available intelligence does not yet reveal the registrar, hosting IP address, ASN, SSL certificate details, or the exact page title displayed by the site. Consequently, the full infrastructure footprint remains uncertain, and no specific brand or service impersonated by the site has been confirmed. The lack of additional contextual data limits the ability to attribute the campaign to a particular threat actor or to assess the breadth of the phishing infrastructure. Defenders should add slon7.cl to their deny‑list and ensure that any outbound connections to the domain are blocked at the network perimeter.

Continuous monitoring of DNS queries for the domain is recommended, as well as periodic re‑scanning with multi‑vendor services to capture any changes in detection status. Organizations that employ email filtering should treat any messages containing links to slon7.cl as malicious and quarantine them. Because the campaign is still active, threat‑intel teams should watch for related indicators of compromise, such as newly registered domains with similar lexical patterns, to pre‑empt further propagation.