slon7[.]at

Analysis of the domain slon7.at, registered through Key-Systems GmbH, shows that the site is currently active and has been listed on a single security blocklist. The blocklist entry is reinforced by an explicit block from PhishDestroy, indicating that the domain is being used for malicious purposes. Infrastructure inspection reveals that the domain resolves to the IP address 64.190.63.222 and is served by the parking nameservers ns1.sedoparking.com and ns2.sedoparking.com, a configuration frequently observed in abuse campaigns that rely on shared hosting environments.

VirusTotal has recorded 91 vendor scans for this host; none of the scanners reported a detection, but the absence of a flag does not constitute evidence of benign behavior. No additional metadata such as SSL certificate details, HTTP response codes, or page‑title information is available, and public observations of the site’s content have not been reported. Consequently, the precise brand or service being impersonated remains unknown.

Defenders should treat the domain as a high‑confidence phishing indicator based on its blocklist status and the presence of a dedicated anti‑phishing block. Recommended remediation steps include adding slon7.at to local deny lists, blocking outbound traffic to 64.190.63.222, and monitoring for any future changes in the domain’s hosting or content that could reveal the targeted brand. Continuous re‑scanning with multi‑vendor services is advised to capture any emerging malicious payloads or alterations to the site’s behavior.