slon-2[.]net

Analysis of slon-2.net indicates an active credential phishing campaign targeting users associated with the domain slon2.cc, as evidenced by the page title and HTTP 301 redirect behavior. The domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, and currently resolves to IP address 172.67.154.71, hosted on Cloudflare's infrastructure (AS13335). Nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com further confirm Cloudflare as the DNS provider, while the SSL certificate issued by Let's Encrypt (serial E7) suggests automated certificate provisioning typical of phishing operations. Seven of ninety-three security vendors on VirusTotal have flagged this domain, though the specific detection rules or payloads remain unconfirmed. The domain appears on at least one security blocklist and holds a trust score of 0/100, reinforcing its malicious classification. Technologies detected include Yandex.Metrika, a web analytics service often abused for tracking victim interactions, alongside Cloudflare's CDN and HTTP/3 protocol support. Defenders should prioritize blocking slon-2.net at the DNS and network layers, particularly given its Cloudflare-hosted status, which may complicate takedown efforts. The domain's recent registration and active redirect chain suggest ongoing abuse, though the exact phishing kit or targeted brand—beyond the slon2.cc reference—has not been fully analyzed. Monitoring for additional domains registered through NiceNIC with similar naming patterns or Cloudflare infrastructure may help identify related threats. No evidence currently links this campaign to broader credential theft operations, but the use of analytics tracking warrants further investigation into victim profiling tactics.