slon-spa[.]com

This domain is flagged as a credential harvesting phishing site, posing an elevated risk to users. Analysis indicates the infrastructure was designed to mimic legitimate login portals, likely to capture sensitive authentication details such as usernames, passwords, and potentially multi-factor authentication codes. The domain's deceptive intent is supported by its technical configuration and detection metrics. Infrastructure analysis reveals the domain resolves to IP address 91.105.200.78 and was registered through Internet Invest, Ltd. dba Imena.ua. The domain was created on March 28, 2026, an anomalous future date suggesting potential registration system manipulation or data entry error. It is flagged by 3 out of 95 security vendors on VirusTotal and appears on one security blocklist. The domain holds a Gridinsoft trust score of 0/100 and was referenced in one AlienVault OTX threat intelligence pulse. The SSL certificate is issued by Let's Encrypt, which, while providing encryption, does not validate the legitimacy of the site. Mitigation steps for this credential harvesting threat include immediate blocking of the domain and its associated IP address (91.105.200.78) at the network perimeter. Security teams should review logs for connections to this domain or IP, particularly those involving authentication attempts. End-user awareness should be reinforced to recognize phishing indicators, such as anomalous domain names, unexpected login prompts, and SSL warnings. If credentials were entered on this site, affected accounts should be identified, credentials reset, and additional authentication factors reviewed or revoked. Monitoring for secondary compromise, such as unauthorized access or lateral movement, is recommended.