slon-at[.]com

The domain slon-at.com has been identified as a credential harvesting phishing site designed to deceive users into submitting login credentials through fraudulent web portals. Analysis indicates this domain is not impersonating a specific well-known brand but instead employs generic login templates to capture sensitive information. As of the latest assessment, the domain is currently offline, though its prior activity warrants continued monitoring. Infrastructure analysis reveals the domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 188.114.96.3, which has been linked to other malicious activities in recent threat intelligence reports. Detection metrics show that 17 of 95 security vendors on VirusTotal have flagged slon-at.com as malicious, while it appears on one security blocklist. Additionally, the domain has been documented in a threat intelligence pulse on AlienVault OTX, further corroborating its involvement in phishing operations. Given the elevated risk level and historical activity, organizations and users are advised to treat this domain as compromised. Network-level blocking of the IP 188.114.96.3 is recommended to prevent potential redirects or residual threats. Endpoint protection systems should be updated to include slon-at.com in deny lists, and users should be educated on recognizing generic phishing attempts, particularly those using non-branded login interfaces. Continuous monitoring of related infrastructure is advised, as threat actors may re-establish operations under similar domains or IPs.