slon3-at[.]com

slon3-at.com is an active phishing infrastructure observed since its registration on 28 February 2026. The domain resolves to 104.21.34.115, an address owned by Cloudflare (AS13335) and is served through Cloudflare’s DNS with the authoritative nameservers malavika.ns.cloudflare.com and watson.ns.cloudflare.com. The site presents a TLS certificate issued by Let’s Encrypt and supports HTTP/3, indicating a modern web stack. Cloudflare Browser Insights are detected, suggesting the operator is leveraging Cloudflare’s performance and masking services. Intelligence confirms the domain is being used for a fraudulent login page referencing “Кракен”, which aligns with a credential‑harvesting campaign targeting users of the Kraken service. The page title “slon3.at — Актуальный вход по ссылке Кракен | 2026” reinforces this attribution. A trust scoring system assigned a score of 0/100, and four of ninety‑three security scanners flagged the domain as malicious, while it appears on one external blocklist. The combination of recent creation, low trust rating, and confirmed phishing activity places the domain at high risk. Defenders should block the domain and its associated IP at network perimeters, add the nameservers to DNS filtering rules, and monitor for similar Cloudflare‑hosted domains created after February 2026 that reference Kraken. Continuous re‑scanning with malware and URL reputation services is advised to capture any changes in detection status.