slon13at[.]com

This domain, slon13at.com, is currently flagged as an active phishing threat targeting user credentials. Analysis indicates the domain was registered on March 13, 2026, through NiceNIC International Group Co., Limited, and resolves to the IP address 104.21.61.143, hosted on Cloudflare’s infrastructure (AS13335). The site returns an HTTP 301 redirect status, which is commonly used in phishing campaigns to forward victims to malicious landing pages or to obscure the final destination. The SSL certificate is issued by Let’s Encrypt, a legitimate provider often abused by threat actors to lend false credibility to phishing domains. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights and HTTP/3, which may help the domain evade detection by leveraging encrypted traffic and content delivery network protections. The domain appears on at least one security blocklist and is flagged by 3 out of 95 security vendors on VirusTotal, though the specific detection rules or payloads are not publicly detailed. The page title, slon13.at, suggests an attempt to impersonate or mimic a legitimate Austrian domain, which may indicate a targeted campaign against users familiar with that region or brand. Defenders should treat this domain as high-risk due to its recent registration, use of Cloudflare to mask infrastructure, and active phishing classification. The HTTP 301 redirect behavior warrants further investigation to determine the final destination or payload. Network-level blocking of 104.21.61.143 and associated domains using the same nameservers (blair.ns.cloudflare.com, lochlan.ns.cloudflare.com) is recommended. Monitoring for connections to this domain in proxy or DNS logs may help identify compromised endpoints or ongoing phishing attempts within an organization. No legitimate business use has been identified for this domain, and its low trust score (0/100) further supports its classification as malicious.