slon6[.]at

The domain slon6.at is currently flagged as a generic phishing site. DNS resolution points to the IPv4 address 64.190.63.222, which is hosted on the Sedo parking name servers ns1.sedoparking.com and ns2.sedoparking.com. The domain appears on a single public blocklist and has been explicitly blocked by the PhishDestroy service, indicating that at least one security feed has observed malicious activity associated with it. VirusTotal records show that the domain was submitted to 91 scanning engines; none of the engines returned a detection at the time of analysis.

While the lack of detections does not constitute evidence of benign behavior, it demonstrates that the sample has not yet triggered signatures in the examined vendor set. No additional metadata such as registrar information, SSL certificate details, HTTP response codes, or page title content is presently available, leaving the surface‑web characteristics of the site unverified. The absence of public threat intelligence from platforms such as OTX or Google Safe Browsing further limits the context for attribution. Defenders should treat slon6.at as a potentially malicious indicator.

It is advisable to add the domain to outbound proxy deny lists and to block any resolution to 64.190.63.222 at the network perimeter. Continuous monitoring of DNS query logs for repeated look‑ups, as well as periodic re‑scans on VirusTotal or similar sandboxes, will help detect any evolution in payload or hosting. Correlating this IP with other active domains in internal logs may reveal shared infrastructure. Because the domain is marked active and under investigation, remediation actions should be prioritized in phishing detection rules and user‑education campaigns.