slon4-at[.]at

The domain slon4-at.at is identified as a credential harvesting phishing site targeting users through deceptive login interfaces. Analysis confirms its current status as offline, though historical activity and infrastructure indicators suggest prior malicious use. No specific brand impersonation has been confirmed, but the domain exhibits characteristics consistent with generic phishing campaigns designed to capture sensitive authentication details. Technical indicators reveal the domain was flagged by 6 of 95 security vendors on VirusTotal, resolving to the IP address 188.114.96.3. The domain was registered on March 28, 2026, an anomalous creation date that may indicate domain spoofing or backdated registration. It appears on one security blocklist, and its SSL certificate is issued by Let’s Encrypt, a common choice for both legitimate and malicious sites. The Gridinsoft trust score for this domain is 0 out of 100, reinforcing its classification as high-risk. Additionally, the page title was recorded as 'Loading...', a tactic often used to mask malicious intent while content is dynamically loaded or redirected. Current infrastructure analysis confirms the domain is offline, though residual risk remains due to its historical use and detection by multiple security vendors. Organizations and users are advised to block access to slon4-at.at at the network level, including DNS and proxy filters. Security teams should monitor for any re-emergence of the domain or associated IP addresses in logs or threat feeds. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are recommended for all potentially compromised accounts. The anomalous creation date warrants further investigation into registrar abuse or domain generation algorithm patterns.