slon10-at[.]net

The domain slon10-at.net has been identified as a credential harvesting platform impersonating the legitimate service slon10.at. Analysis confirms the domain operated as a generic phishing site, designed to deceive users into disclosing authentication credentials. As of the latest assessment, the domain has been taken offline, though prior activity remains a documented security concern. Infrastructure analysis reveals the domain was registered through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. It resolved to the IP address 172.67.153.98 and employed Cloudflare services, including Browser Insights and HTTP/3, to obscure its origin and evade detection. The domain was flagged by 6 of 95 security vendors on VirusTotal, indicating moderate but consistent detection across threat intelligence platforms. Additional indicators include a Gridinsoft trust score of 0/100 and presence on 2 security blocklists. Notably, the domain was created on February 28, 2026, a future date suggesting potential falsification of registration records or a placeholder entry in domain databases. Current status confirms slon10-at.net is no longer accessible, likely due to takedown actions or voluntary suspension. However, the infrastructure and registration patterns observed warrant continued monitoring. Organizations and users are advised to block the domain and its associated IP address at perimeter security controls. Security teams should review logs for connections to 172.67.153.98 or requests to slon10-at.net, particularly those occurring prior to its deactivation. Additionally, domain registration records should be scrutinized for anomalies, such as future-dated creation timestamps, which may indicate fraudulent or spoofed entries.