slon4cc[.]top

The domain slon4cc.top was registered on May 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is currently taken offline. Analysis shows the site resolved to the Cloudflare‑hosted address 172.67.160.44, with authoritative name servers ali.ns.cloudflare.com and zahir.ns.cloudflare.com. Cloudflare technologies detected include Cloudflare Browser Insights and HTTP/3, indicating the use of a modern CDN front‑end. No SSL certificate was observed, which is atypical for a site that attempts to collect credentials.

The page title returned by the server was "slon4.at," a value that does not correspond to a known brand or service and provides no further context about the intended victim set. The domain appears on a single security blocklist and is actively blocked by PhishDestroy. VirusTotal scans recorded 14 detections out of 91 participating vendors, reflecting a moderate consensus among AV engines that the domain is malicious. Gridinsoft assigned a trust score of 0 out of 100, reinforcing the classification as a high‑confidence threat.

The IP address is geolocated to Canada and is owned by Cloudflare, Inc., a common hosting choice for fast‑flux or disposable phishing infrastructure. Uncertainties remain regarding the specific phishing campaign details, such as the targeted brand or credential collection method, because the public page content has not been captured. Defenders should continue to block the domain at perimeter and DNS filtering layers, monitor for any re‑registration attempts, and correlate any outbound traffic to 172.67.160.44 with user activity logs. Threat‑intel teams should also share the indicator set with upstream blocklist providers and consider adding the domain to internal watchlists until the infrastructure is fully dismantled.