zlon8[.]at

Analysis indicates that the domain zlon8.at was associated with generic phishing activities and is currently offline. It resolved to the IP address 178.20.210.35 located in Kazakhstan, under the Shereverov network. This domain was flagged by 6 out of 91 security vendors on VirusTotal, displaying some level of malicious activity. Furthermore, it has been reported in two threat intelligence pulses on AlienVault OTX and appears on one security blocklist, enhancing its threat profile. The domain was utilizing a Let's Encrypt SSL certificate, which is commonly used for securing communications but can also be misused by malicious actors to give the appearance of legitimacy. The HTTP status was recorded as 403, indicating access denial to the resource. Given that zlon8.at has already been taken offline and blocked by PhishDestroy, defenders should continue monitoring similar domains and associated IP ranges to preemptively secure their systems against potential impersonation attempts associated with this threat. Continued vigilance is advised to mitigate risks from any re-emergence of similar phishing campaigns.