slon2to[.]com

slon2to.com is presently classified as a generic_phishing site and assigned a high risk level. The domain was created on February 27, 2026 via NiceNIC International Group Co., Limited and is delegated to the Cloudflare nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com. DNS resolution returns the address 188.114.97.3, which is part of AS13335 Cloudflare, Inc. and is geolocated in the United States. The web service presents a Let’s Encrypt TLS certificate (profile E7) and issues an HTTP 301 redirect, suggesting an intent to forward traffic to a secondary location.

Detection data show that the domain is blocked by PhishDestroy and appears on one public security blocklist. VirusTotal scans have resulted in 4 out of 95 security vendors flagging the domain as malicious, indicating a modest but notable consensus among scanning engines. The site’s technology stack is limited to Cloudflare Browser Insights, Cloudflare services, and HTTP/3, confirming that the infrastructure is fully hosted behind Cloudflare’s edge network.

Publicly available information does not reveal the actual content delivered after the redirect, nor does it disclose any credential‑harvesting forms or malicious payloads. The page title returned by the server is "slon2.to," which matches the domain string but provides no additional context about the targeted brand or campaign objectives. Consequently, the precise phishing lure and victim profile remain uncertain.

Defenders should prioritize immediate blocking of slon2to.com at network and endpoint layers, given its confirmed high‑risk classification and active status. Continuous monitoring of DNS queries for the domain and its associated IP address is advised, as any changes could indicate a shift in hosting or a new payload deployment. Where TLS inspection is possible, analysts should capture the post‑redirect traffic to identify the phishing landing page and extract any indicators of compromise for broader threat‑intel sharing.