slon04[.]com

PhishDestroy identifies slon04.com as an active generic phishing domain engaging in credential harvesting campaigns. This domain employs no discernible brand mimicry or drainer kit deployment, relying on generic lures to trick users into submitting sensitive data. The infrastructure lacks sophistication, suggesting opportunistic targeting rather than highly targeted attacks. Technical analysis confirms this domain resolves to IP 172.67.166.178, with a Let's Encrypt SSL certificate enabling encrypted data exfiltration. No association with known APT groups or organized cybercrime syndicates has been established at this time.

This domain was flagged by 4 out of 95 security vendors on VirusTotal, indicating limited but notable detection coverage. Registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain was created on April 14, 2024, and has already been blocked by Hagezi. The short operational lifespan and early blocklisting suggest rapid reactive measures by threat intelligence platforms. Despite Let's Encrypt's SSL certificate, which may enable evasion of basic detection mechanisms, the domain's inclusion on the Hagezi blocklist underscores its malicious intent. The registrar's association with high-volume, low-friction domain registration raises concerns about its permissiveness toward abuse.

slon04.com remains an active threat, with confirmed malicious activity and partial blocklisting. Users are advised to avoid all interactions with this domain and its subdomains. Security teams should implement network-level blocking via Hagezi or equivalent threat intelligence feeds. The remaining risk is elevated due to the domain's recent creation, low detection rates by mainstream vendors, and potential for rapid propagation through automated phishing campaigns. Proactive scanning of endpoint devices for compromise is recommended, as this domain may serve as a vector for secondary malware delivery. The combination of early-stage domain infancy and moderate detection scores places slon04.com in a high-risk category despite its generic threat profile.