at-slon4[.]cc

PhishDestroy identifies at-slon4.cc as an active phishing domain designed to steal Microsoft 365 login credentials. The site mimics a corporate authentication portal, tricking visitors into entering their work or personal email passwords. Once submitted, stolen credentials are harvested by attackers for account takeovers, data theft, or further phishing campaigns against contacts in the victim's address book. This domain was specifically observed in a credential-harvesting campaign targeting employees with spoofed Office 365 login pages.

The domain was registered on February 18, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolved to IP address 188.114.96.3. Security vendor analysis shows only 2 out of 95 engines detected malicious activity via VirusTotal, highlighting how new and evasive this threat is. Use of a Let's Encrypt SSL certificate adds false legitimacy, making the phishing page appear secure and trustworthy at first glance.

If you visited at-slon4.cc and entered any login details, immediately change your password on the legitimate Microsoft 365 portal and enable multi-factor authentication. Scan your device with an updated antivirus tool and monitor your email and financial accounts for suspicious activity. Report the incident to your IT department or security team if it was work-related. Never reuse the exposed password on other accounts, as attackers may attempt credential stuffing across platforms. Consider using a password manager to prevent reuse and enable breach alerts for early warnings of compromised credentials.