slon10a[.]cc

Analysis of slon10a.cc indicates that the domain is currently active and has been identified as a phishing vector. The domain was registered on 2026-04-10 through NICENIC INTERNATIONAL GROUP CO., LIMITED and is hosted on Cloudflare infrastructure, resolving to the IPv4 address 172.67.146.115. Its authoritative nameservers are damon.ns.cloudflare.com and georgia.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service.

The domain appears on one security blocklist and has been explicitly blocked by the PhishDestroy mitigation platform, reinforcing the assessment of malicious intent. VirusTotal has processed the domain with 91 scanning engines; none of the engines have raised a detection at the time of analysis, but the absence of detections does not constitute a safety guarantee and must be interpreted in the context of limited visibility. No public page title, SSL certificate details, or HTTP response codes are presently available, leaving the content of the site uncharacterized.

Consequently, the primary evidence supporting the phishing designation derives from its blocklist inclusion, active blocking by PhishDestroy, and the rapid creation date typical of abuse-related domains. Defenders should consider adding slon10a.cc to outbound filtering rules, enforce DNS-level blocking, and monitor traffic for connections to the associated Cloudflare IP range. Ongoing observation of any changes in the domain’s reputation, additional blocklist listings, or emergence of detections from sandbox analyses is recommended to adjust mitigation posture promptly.