slon-2[.]com

This domain is currently under investigation for credential theft phishing activity targeting users through deceptive login interfaces. Analysis indicates the infrastructure is designed to harvest account credentials, likely for financial or cryptocurrency-related services, given the observed page title redirecting to slon5.cc, a known phishing gateway pattern. Infrastructure analysis reveals the domain slon-2.com resolves to IP address 104.21.67.58, a Cloudflare-protected endpoint utilizing HTTP/3 and Cloudflare Browser Insights for performance tracking. The domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. Detection metrics show 0/95 detections on VirusTotal, though it appears on one security blocklist and was previously blocked by PhishDestroy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains due to its free and automated issuance process. Users and organizations are advised to implement the following mitigation measures specific to credential theft threats. First, block the domain slon-2.com and its associated IP 104.21.67.58 at the network perimeter to prevent access. Second, monitor for signs of compromised credentials, particularly for accounts accessed during the domain's active period. Third, deploy multi-factor authentication (MFA) across all critical accounts to mitigate the impact of stolen credentials. Finally, conduct security awareness training to educate users on recognizing phishing attempts, particularly those impersonating login portals or redirecting to unfamiliar domains like slon5.cc.