at-slon1--cc[.]net

This domain, at-slon1--cc.net, operates as a credential theft portal designed to deceive users into submitting login credentials through fraudulent web forms. Victims are typically redirected from compromised links or malicious advertisements, where they encounter realistic but fake login pages mimicking legitimate services. The goal is to harvest usernames, passwords, and other sensitive data for unauthorized account access or identity theft. Analysis indicates this domain was registered on March 27, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It resolves to the IP address 172.67.162.8 and is flagged by 4 out of 95 security vendors on VirusTotal. The domain appears on one security blocklist and is referenced in a single AlienVault OTX threat intelligence pulse, suggesting limited but confirmed malicious activity. The Gridinsoft trust score of 0/100 further corroborates its classification as a high-risk entity. If you visited at-slon1--cc.net or entered credentials on a site resembling it, immediate action is required. First, change passwords for any accounts accessed from the suspicious site, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for unusual activity, such as unrecognized logins or transactions, and report any anomalies to the respective service providers. Additionally, scan the device used to visit the domain for malware, as credential theft sites often deploy secondary payloads. Users should also review browser extensions and installed applications for unfamiliar or unauthorized software.