slon[.]at

PhishDestroy identifies slon.at as a live fake-login phishing domain engineered to trick visitors into surrendering usernames and passwords. The page pretends to be a legitimate login portal but transmits everything entered directly to attackers, giving them full account takeover capability on any service the victim re-uses credentials for. slon.at resolves to IP 116.203.157.60 and currently benefits from a still-valid DigiCert SSL certificate, which increases its visual credibility but does not guarantee safety.

This domain was flagged by PhishDestroy’s crawlers on seed b7f7dc after it passed through VirusTotal’s multi-engine scan undetected (0 detections out of 95 engines at the moment of writing). Historical lookups show the domain is newly registered through a privacy-protected registrar, which is common for phishing operators seeking anonymity. The absence of detections does not mean the site is safe; it simply means antivirus signatures have not yet caught up with the fresh infrastructure.

If you visited slon.at or entered any information on the page, immediately change the password you provided and enable multi-factor authentication on every related account. Run a reputable antivirus scan on your device and consider revoking any browser-stored credentials that may have synced with the phishing form. Report the URL to your IT team or bank if financial data was involved, and warn colleagues who might receive similar lures.