slon4[.]net

PhishDestroy identifies slon4.net as an active generic phishing domain leveraging deceptive tactics to steal credentials or sensitive data. While no specific brand or drainer kit is directly associated with this domain in current threat feeds, its rapid registration (February 16, 2026) and minimal security vendor coverage (4/95) suggest opportunistic malicious intent. The absence of a branded decoy implies a broader, untargeted campaign aimed at broad victim pools rather than high-value entities. This domain resolves to IP 188.114.97.3 and is registered through NICENIC INTERNATIONAL GROUP CO., LIMITED. Security vendor detection remains low at 4/95, indicating limited visibility in threat intelligence platforms. The domain holds a valid SSL certificate issued by Let’s Encrypt, potentially enhancing its credibility to unsuspecting users. With a creation date only days ago, its lack of historical trust data amplifies risk—especially when combined with the absence of inclusion in major blocklists or Google Safe Browsing (GSB) at this time. As of now, slon4.net remains active and poses an elevated risk due to its fresh registration and low detection baseline. Immediate defensive actions include adding the domain and its resolved IP (188.114.97.3) to organizational blocklists, disabling SSL inspection bypass where applicable, and alerting end users to avoid interaction. While the immediate threat can be mitigated through proactive blocking, the domain’s short operational history leaves open the possibility of rapid evolution or shift in infrastructure. Continuous monitoring remains essential to detect secondary infrastructure or changes in campaign targeting.