slon8-at[.]net

This domain, slon8-at.net, is identified as a credential harvesting phishing site targeting users through deceptive login portals. Analysis indicates the domain was designed to mimic legitimate authentication pages, likely to capture sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. The infrastructure and page title (slon8.at) suggest an intent to impersonate a legitimate service, increasing the likelihood of successful social engineering attacks against unsuspecting users. Evidence supporting this assessment includes detection by 3 out of 95 security vendors on VirusTotal, registration through NiceNIC International Group Co., Limited, and a creation date of February 28, 2026. The domain resolves to the IP address 172.67.196.22 and is protected by Cloudflare, a common tactic to obscure hosting details and evade takedowns. Additionally, it appears on one security blocklist and is actively blocked by PhishDestroy. The SSL certificate issued by Let’s Encrypt further lends a veneer of legitimacy, while the use of Yandex.Metrika indicates tracking capabilities to monitor victim interactions. Users who visited slon8-at.net should immediately revoke any credentials entered on the site, particularly if reused across other platforms. Monitor accounts associated with the compromised credentials for unauthorized activity, such as logins from unfamiliar locations or devices. Enable multi-factor authentication where available to mitigate the risk of account takeover. If financial or personally identifiable information was submitted, consider placing a fraud alert on credit files and reviewing transaction histories for suspicious activity. Organizations should update blocklists to include this domain and its associated IP address (172.67.196.22) to prevent further access attempts.