slon4[.]to

The domain slon4.to is currently flagged for credential theft and is active. This domain appears to be involved in a phishing campaign designed to steal user credentials, potentially targeting specific brands or organizations.

Analysis indicates that slon4.to has been flagged by 13 out of 95 security vendors on VirusTotal, suggesting a moderate level of consensus among security professionals regarding its malicious nature. The domain is registered through the Government of the Kingdom of Tonga and was created on March 28, 2026. The SSL certificate for this domain is issued by DigiCert Inc, which may lend a false sense of security to unsuspecting users. According to AlienVault OTX, the domain has been found in 1 threat intelligence pulse, and it appears on 1 security blocklist, indicating that it has been identified and tracked by security researchers. The domain is also blocked by a security service known as PhishDestroy, further confirming its association with malicious activities.

Given the elevated risk level and the current active status of slon4.to, it is strongly recommended that users avoid interacting with this domain. Organizations should update their firewall and DNS blocklists to include slon4.to and conduct regular security awareness training to educate employees about the risks of phishing and credential theft. Additionally, network administrators should monitor for any unexpected traffic to this domain and deploy advanced threat detection mechanisms to catch and mitigate any potential compromise.