slon-4[.]net

The domain slon-4.net is under investigation for credential theft. This domain does not impersonate a specific brand but is designed to harvest user credentials through deceptive techniques. The domain's infrastructure and technical setup suggest a sophisticated approach to phishing, utilizing multiple layers of obfuscation and analytics tools.

Analysis indicates that slon-4.net has a VirusTotal score of 0/95, indicating no detections by the engines on VirusTotal at the time of analysis. The domain is registered through NiceNIC International Group Co., Limited and resolves to the IP address 172.67.167.83. It was created on February 27, 2026, and is currently flagged on two security blocklists: PhishDestroy and OISD. The domain employs technologies such as Yandex.Metrika, Cloudflare Browser Insights, and Cloudflare, and uses an SSL certificate from Google Trust Services. The use of HTTP/3 suggests an attempt to improve the phishing site's performance and user experience.

The current status of slon-4.net is offline, which reduces the immediate risk of credential theft. However, the domain's offline status does not necessarily mean the threat is neutralized, as it could be reactivated. Security teams are advised to monitor the domain for any signs of reactivation and to ensure that it remains blocked in security filters. Users should avoid visiting this domain and report any suspicious activity to their IT departments. The remaining risk is under investigation, and further analysis may reveal additional threat vectors or indicators.