# PhishDestroy domain threat record: captcha-slon6.at Content language: English Canonical HTML report: https://phishdestroy.io/domain/captcha-slon6.at/ Machine-readable companion: https://phishdestroy.io/domain/captcha-slon6.at/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: not observed active - First observed by PhishDestroy: 2026-10-16 01:37:54 UTC - Last availability or vendor check: 2026-10-21 01:19:50 UTC - Stored record updated: 2026-10-22 14:21:26 UTC - VirusTotal detections in the stored snapshot: 1/92 - Independent public blocklist matches in the stored snapshot: 0 - Google Safe Browsing stored result: no stored flag ## Stored infrastructure - Observed IP address: 104.21.67.54 - Registrar in stored WHOIS data: Gransy s.r.o. ( https://nic.at/registrar/609 ) - Last stored HTTP status: 403 ## Evidence links - URLScan report: https://urlscan.io/result/01a14265-662e-743f-9cee-c114c0f0c584/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/captcha-slon6.at - Certificate Transparency search: https://crt.sh/?q=%25.captcha-slon6.at - Web Archive lookup: https://web.archive.org/web/*/https://captcha-slon6.at/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview captcha-slon6.at served an impersonation phishing page titled "Авторизация", Russian for "Authorization". That points to Russian-speaking users who were asked to sign in to a service the page pretended to be. PhishDestroy first saw the domain on 2026-10-16. It went offline on 2026-10-17 after its content was blocked at the provider level, and it was still dead when last checked on 2026-10-19. How the scam works Impersonation pages copy the look of a legitimate login screen so visitors type their real username and password without suspicion. Here the page presented itself as a plain authorization step, and anything entered in its form went to the operators rather than the real service. Stolen logins are typically used quickly to take over the account, change its recovery details, and reuse the same password on other sites. Some victims are also asked for one-time codes, which hand the attacker a way past two-factor protection. Evidence Independent coverage is thin, which is common for short-lived phishing domains. On 2026-10-16, only SOCRadar flagged it among 92 VirusTotal engines, so most scanners would have shown it as clean while it was live. The domain appears in four AlienVault OTX threat pulses, meaning other researchers had also linked it to malicious activity. PhishDestroy lists it on its own blocklist. Infrastructure The .at domain was registered through Gransy s.r.o. Its traffic ran through Cloudflare's network in the United States, so the IP address 104.21.67.54 belongs to Cloudflare's proxy rather than the operators' origin server. The site used a Google Trust Services WE1 certificate, so it showed a normal browser padlock even though it was a phishing page. It lasted roughly a day after PhishDestroy first saw it before the provider pulled the content. What to do If you entered a password on this page, change it right away on the real service and on any other account where you reused it. Then turn on or reset two-factor authentication and sign out of all active sessions. Check the account's recovery email, phone number, and recent activity for changes you did not make. If you entered a one-time code, assume the session was hijacked and contact the service's support. Defenders should block the domain and look in proxy and DNS logs for users who reached it between 2026-10-16 and 2026-10-17. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a14265-662e-743f-9cee-c114c0f0c584/ VirusTotal report: https://www.virustotal.com/gui/domain/captcha-slon6.at Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=captcha-slon6.at Archived copy: https://web.archive.org/web/20261016013854/https://captcha-slon6.at/ Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-19 10:13:16 UTC ## Stored page captures - Primary capture: https://i.ibb.co/39PzhhPn/75e48b9ecc08.png Captured: 2026-10-16 01:49:51 UTC - URLScan capture 1: https://screenshots.phishdestroy.io/01a14265-662e-743f-9cee-c114c0f0c584.png Captured: 2026-10-16 01:49:51 UTC Source report: https://urlscan.io/result/01a14265-662e-743f-9cee-c114c0f0c584/ - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a1425b-d34a-7094-8655-0b8a9032b91a.png Captured: 2026-10-16 01:38:01 UTC Source report: https://urlscan.io/result/01a1425b-d34a-7094-8655-0b8a9032b91a/ SHA-256: 6ec505a737098a98dd97c78b4c1c81a46bf62239baa96b9628d276bb5d5a1a9d - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/e114de89-2c80-4d47-a44d-8cb891f5492a.png Captured: 2026-10-16 01:50:16 UTC Source report: https://radar.cloudflare.com/scan/e114de89-2c80-4d47-a44d-8cb891f5492a SHA-256: 6126eabda4cf36051d00610eb1dddaea01aec25305d110b750486d4f434926c6 - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14259-fb6b-7111-a3da-d27f82cd7372.png Captured: 2026-10-16 01:36:06 UTC Source report: https://urlscan.io/result/01a14259-fb6b-7111-a3da-d27f82cd7372/ SHA-256: 6ec505a737098a98dd97c78b4c1c81a46bf62239baa96b9628d276bb5d5a1a9d - URLScan · 2026-10-16: https://screenshots.phishdestroy.io/us/01a14261-3213-714b-ab55-41b3946f0cc4.png Captured: 2026-10-16 01:43:53 UTC Source report: https://urlscan.io/result/01a14261-3213-714b-ab55-41b3946f0cc4/ SHA-256: 6ec505a737098a98dd97c78b4c1c81a46bf62239baa96b9628d276bb5d5a1a9d ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T17:46:07Z", "uuid": "01a14265-662e-743f-9cee-c114c0f0c584", "scanned_at": "2026-10-16T01:48:32Z", "final_url": "https://captcha-slon6.at/", "status": 200, "ip": "104.21.67.54", "domains": [ "fonts.gstatic.com", "fonts.googleapis.com", "static.cloudflareinsights.com" ], "ips": [ "142.250.207.3", "104.16.80.73", "142.251.42.106", "104.21.67.54" ], "asns": [ "15169", "13335" ], "countries": [ "US" ], "doc_hash": "c1ad9c1d67b309f49cbf1c170765d6e2cfb098222ce7bad62c2992b4224d4d67", "globals": [ "__cfBeacon" ], "tls": { "san": [ "captcha-slon6.at", "*.captcha-slon6.at" ], "cipher": "AES_128_GCM", "issuer": "WE1", "subject": "captcha-slon6.at", "protocol": "TLS 1.2", "valid_to": "2026-11-22T13:05:30Z", "valid_from": "2026-08-24T12:06:52Z" }, "domain_age_days": 52, "apex_age_days": 52, "tls_age_days": 52, "tls_valid_days": 90, "requests": 9, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 95, "malicious": true }, "overall": { "score": 0, "malicious": false } }, "headers": { "server": "cloudflare", "content-type": "text/html; charset=utf-8" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:59:21Z", "uuid": "e114de89-2c80-4d47-a44d-8cb891f5492a", "scanned_at": "2026-10-16T01:50:16Z", "final_url": "https://captcha-slon6.at/", "status": 200, "history": [ { "url": "https://captcha-slon6.at/", "status": 200 } ], "dom_hash": "6a5b5eace2261fa6a830c78d5be97502bb7c680f910f4f26621e3595cb09ba04", "doc_hash": "c1ad9c1d67b309f49cbf1c170765d6e2cfb098222ce7bad62c2992b4224d4d67", "phishing_v2": [ "phishing" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "captcha-slon6.at", "type": "A", "value": "104.21.67.54" }, { "name": "captcha-slon6.at", "type": "A", "value": "172.67.213.213" }, { "name": "captcha-slon6.at", "type": "AAAA", "value": "2606:4700:3033::6815:4336" }, { "name": "captcha-slon6.at", "type": "AAAA", "value": "2606:4700:3031::ac43:d5d5" } ], "dnssec_valid": false, "ip": "104.21.67.54", "whois": { "registrar": "Gransy s.r.o. ( https://nic.at/registrar/609 )", "created": "2026-02-27T07:57:02Z", "updated": "2026-08-24T14:16:01Z", "nameservers": [ "ali.ns.cloudflare.com", "zahir.ns.cloudflare.com" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T19:45:39Z", "analysis_at": "2026-10-18T01:27:38Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 1, "suspicious": 1, "undetected": 36 }, "detections": { "SOCRadar": "suspicious", "alphaMountain.ai": "phishing" }, "reputation": 0, "categories": { "alphaMountain.ai": "Phishing (alphaMountain.ai)" }, "registrar": "Gransy s.r.o. ( https://nic.at/registrar/609 )", "first_seen": "2026-06-23T01:16:42Z", "dns": [ { "ttl": 300, "type": "A", "value": "172.67.213.213" }, { "ttl": 21600, "type": "NS", "value": "ali.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3033::6815:4336" }, { "ttl": 1800, "type": "SOA", "rname": "dns.cloudflare.com", "value": "ali.ns.cloudflare.com" }, { "ttl": 300, "type": "AAAA", "value": "2606:4700:3031::ac43:d5d5" }, { "ttl": 300, "type": "A", "value": "104.21.67.54" }, { "ttl": 21600, "type": "NS", "value": "zahir.ns.cloudflare.com" } ], "dns_at": "2026-10-18T01:27:52Z", "jarm": "27d40d40d00040d1dc27d40d27d40d5fb4c89fe3813d172ffb53f84a68f750", "cert": { "san": [ "captcha-slon6.at", "*.captcha-slon6.at" ], "issuer": "Google Trust Services / WE1", "serial": "aec7c6a8604dd9e0eb7d215375cc6df", "sha256": "79a9974affd933bc40f478908a0572f6febd31d2add187682a17782148346a74", "subject": "captcha-slon6.at", "valid_to": "2026-11-22T13:05:30Z", "valid_from": "2026-08-24T12:06:52Z" }, "whois": { "registrar": "Gransy s.r.o. ( https://nic.at/registrar/609 )" } } } ```