slon6at[.]net

This domain, slon6at.net, is identified as a credential theft site designed to harvest login credentials by impersonating the legitimate service slon6.at. The page title explicitly mimics the authentic domain, increasing the likelihood of successful deception. Infrastructure analysis reveals the site employs social engineering tactics to trick users into entering sensitive information, which is then exfiltrated to attacker-controlled servers for unauthorized access or financial fraud. Evidence supporting this assessment includes detection by 7 out of 95 security vendors on VirusTotal, indicating a moderate but consistent level of malicious recognition. The domain was registered on March 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. It appears on one security blocklist and was flagged in a single AlienVault OTX threat intelligence pulse. The domain resolves to the IP address 188.114.96.3 and uses an SSL certificate issued by Google Trust Services, which may lend a false sense of legitimacy to unsuspecting users. Users who visited slon6at.net should immediately terminate any active sessions and avoid entering credentials or personal information. If credentials were submitted, affected accounts must be secured by changing passwords and enabling multi-factor authentication where available. Monitor linked accounts for unauthorized activity, such as logins from unfamiliar locations or devices. Network administrators should block the domain and its associated IP address (188.114.96.3) at the perimeter to prevent further access. Review logs for connections to slon6at.net or the IP to identify potentially compromised systems within the environment.