sloni1[.]at

This domain, sloni1.at, is actively engaged in phishing operations designed to harvest user credentials through fake login portals. Visitors to the site are presented with a deceptive interface mimicking legitimate authentication pages, increasing the risk of account compromise and unauthorized access to sensitive information. The site is structured to capture login details entered by unsuspecting users, which are then likely transmitted to threat actors for further exploitation. Analysis indicates that sloni1.at was registered on March 28, 2026, through Dynadot INC, a registrar commonly associated with domains used in phishing campaigns. The domain resolves to the IP address 185.53.179.128, which has been flagged in multiple threat intelligence feeds. As of the latest assessment, 9 out of 95 security vendors on VirusTotal have detected this domain as malicious, reflecting an elevated risk level. Additionally, the domain appears on one security blocklist and has been identified in a threat intelligence pulse on AlienVault OTX, further corroborating its involvement in phishing activities. Individuals who have visited sloni1.at or entered credentials on the site should take immediate action to mitigate potential risks. First, reset passwords for any accounts accessed or entered on the site, prioritizing those linked to financial services, email, or other sensitive platforms. Enable multi-factor authentication where available to add an additional layer of security. Monitor accounts for unusual activity, such as unauthorized logins or transactions, and report any suspicious behavior to the relevant service providers. If the site was accessed on a corporate or shared device, notify the IT or security team to conduct a thorough review and prevent further exposure.