slon3to[.]com

This domain, slon3to.com, was actively used for credential harvesting phishing campaigns targeting users through deceptive login interfaces. The site mimicked legitimate authentication portals to trick visitors into submitting sensitive account details, including usernames, passwords, and potentially multi-factor authentication codes. Such attacks are commonly used to gain unauthorized access to email accounts, financial services, or corporate networks for further exploitation or data theft. Analysis indicates the domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited, a registrar frequently associated with high-risk domains. At the time of assessment, the domain was flagged by 5 out of 95 security vendors on VirusTotal, confirming its malicious classification. Infrastructure analysis reveals the site resolved to IP address 172.67.203.200 and was listed on at least one security blocklist prior to being taken offline. The page title, slon3.to, suggests an attempt to impersonate or redirect to a similarly named legitimate service. Users who visited slon3to.com should immediately change passwords for any accounts accessed or entered on the site. Enable multi-factor authentication on all critical services, even if credentials were not explicitly submitted. Monitor accounts for unauthorized activity, such as unfamiliar logins or transactions, and report any suspicious behavior to the respective service providers. If corporate credentials were exposed, notify internal security teams to assess potential lateral movement risks. Clear browser cache and cookies to remove any residual session data, and verify the legitimacy of any unexpected follow-up communications.