slon13cc[.]com

Analysis indicates that the domain slon13cc.com was registered on March 13, 2026 through NiceNIC International Group Co., Limited. The domain resolves to the IP address 188.114.96.3, which is part of the Cloudflare network (AS13335) located in the United States. HTTP requests receive a 301 redirect and the page title presented to visitors is slon13.cc. The site serves a valid TLS certificate issued by Let’s Encrypt (E8).

The infrastructure is observable on one public security blocklist and has been actively blocked by PhishDestroy. AlienVault OTX references the domain in nine separate threat pulses, indicating recurring malicious use. Gridinsoft assigns a trust score of 0 out of 100, and VirusTotal reports that 4 of 95 security vendors have flagged the domain as malicious. The risk level is classified as high and the domain remains active.

Nameserver resolution points to blair.ns.cloudflare.com and lochlan.ns.cloudflare.com, confirming the use of Cloudflare’s DNS services. The combination of a zero trust score, multiple vendor detections, and inclusion in threat intelligence feeds aligns with a generic phishing operation, though the specific phishing page content, targeted brands, or credential‑harvesting mechanisms have not been disclosed in the available data.

Defenders should add slon13cc.com to network blocklists and enforce DNS filtering to prevent resolution. Monitoring for outbound connections to 188.114.96.3 and applying TLS inspection can help detect any attempted data exfiltration. Consider sinkholing the IP address and tracking related OTX pulses for emerging indicators of compromise. Continuous vigilance is recommended given the high‑risk classification and active status of the domain.