slon8-at[.]com

This domain, slon8-at.com, is flagged as a generic phishing site targeting users through credential harvesting tactics. Analysis of the page title, which mirrors the legitimate domain slon8.at, suggests an attempt to deceive visitors into submitting login credentials or personal information. No specific drainer kit or brand impersonation beyond the slon8.at mimicry has been conclusively identified at this stage, though further forensic analysis of the offline content may reveal additional indicators of compromise. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 172.67.135.90, a Cloudflare-hosted endpoint, and was registered on February 28, 2026, through NiceNIC International Group Co., Limited. The domain currently holds a VirusTotal detection score of 0/95, indicating no antivirus engines have flagged it as malicious. However, it appears on one security blocklist and was proactively blocked by at least one threat intelligence feed. The SSL certificate is issued by Google Trust Services, and the site employs Cloudflare Browser Insights and HTTP/3 for performance and obfuscation. As of the latest assessment, slon8-at.com has been taken offline, reducing immediate risk to end users. However, the domain remains registered and could be reactivated or repurposed for future phishing campaigns. The anomalous creation date (February 2026) may indicate a typo-squatting or pre-registered domain intended for malicious use. Organizations are advised to monitor DNS logs for connections to 172.67.135.90 and review proxy or firewall logs for any residual traffic to slon8-at.com. Users who accessed the domain prior to its takedown should rotate credentials and enable multi-factor authentication on associated accounts.