at-slon7[.]cc

The domain at-slon7.cc is currently under investigation for generic phishing activity targeting user credentials through fake login portals. As of the latest analysis, the domain remains offline, though its infrastructure and registration details suggest malicious intent. No specific brand impersonation has been confirmed, but the domain's design and behavior align with credential harvesting tactics. Infrastructure analysis reveals the domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on March 28, 2026, and resolves to the IP address 172.67.137.188. It employs Cloudflare services, including Cloudflare Browser Insights and HTTP/3, with a Let's Encrypt SSL certificate. Detection metrics indicate minimal flagging, with 0 of 95 vendors on VirusTotal marking it as malicious. Gridinsoft assigns a trust score of 0/100, and the domain appears on one security blocklist. The page title, slon7.cc, suggests a possible connection to a broader phishing campaign or a placeholder for future malicious activity. Current status confirms the domain is offline, though its registration remains active. Organizations are advised to monitor network traffic for connections to 172.67.137.188 or requests to at-slon7.cc. Security teams should update blocklists to include this domain and its associated IP, particularly if credential theft or phishing campaigns are a known threat vector. Given the domain's recent creation and low detection rates, proactive monitoring for related infrastructure or newly registered lookalike domains is recommended.