slon8to[.]com

The domain slon8to.com was registered on March 13, 2026 through NiceNIC International Group Co., Limited and is currently active. It is classified as a high‑risk generic phishing infrastructure, with a 301 HTTP redirect and a page title of “slon8.to”. No specific brand or service is advertised on the landing page, indicating that the site is likely used as a credential‑harvesting conduit for a variety of targets.

Infrastructure analysis reveals that slon8to.com resolves to the IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc., and is served from the United States. The domain is delegated to the Cloudflare authoritative nameservers blair.ns.cloudflare.com and lochlan.ns.cloudflare.com, and presents a valid Let’s Encrypt SSL certificate (E8). Reputation services show a Gridinsoft trust score of 0 out of 100, and the domain appears on one public blocklist. It has been flagged by the PhishDestroy sinkhole and is listed in nine AlienVault OTX pulses, underscoring its active use in phishing campaigns.

VirusTotal scans report that three out of ninety‑five security vendors have flagged the domain, providing additional confirmation of malicious intent. The combination of a recent registration, low trust score, and multiple intelligence sources citing the domain as hostile suggests a coordinated effort to lure victims to a fraudulent site, even though the exact impersonated brand remains unidentified.

Defenders should prioritize immediate blocking of slon8to.com at network perimeter and DNS layers, incorporate the domain into email security rule‑sets, and monitor for any related C2 activity emanating from 188.114.97.3. Continuous threat‑intel feeds should be consulted for updates, and any observed traffic to the domain should be logged and investigated to prevent credential compromise.