slon6to[.]com

The domain slon6to.com is currently under investigation for credential harvesting phishing activity. Analysis indicates the domain was operational but has since been taken offline. No specific brand impersonation has been confirmed at this stage, though the infrastructure aligns with typical phishing deployments targeting login credentials or sensitive user data. Infrastructure analysis reveals the domain was registered on February 27, 2026, through NiceNIC International Group Co., Limited. It resolved to the IP address 188.114.97.3 and was flagged on one security blocklist. VirusTotal reported zero detections out of 95 vendors, suggesting the domain had not yet been widely recognized as malicious. The SSL certificate was issued by Let's Encrypt, and the site employed technologies including Yandex.Metrika, Cloudflare, and HTTP/3. The page title displayed as "slon6.to," which may indicate an attempt to mimic or redirect to a legitimate service. The domain is currently offline, though its recent registration and technical indicators warrant continued monitoring. Organizations are advised to review logs for connections to 188.114.97.3 or the domain slon6to.com, particularly during the period it was active. If any internal access is detected, credentials potentially exposed should be reset, and affected systems should be scanned for compromise. Security teams should also consider preemptively blocking the domain and associated IP in perimeter defenses to prevent future access attempts.