slon-4--at[.]ru

This domain, slon-4--at.ru, operates as a fake login portal designed to harvest user credentials. Victims are typically lured through deceptive emails or messages impersonating legitimate services, such as email providers, cloud storage platforms, or corporate login pages. Once entered, credentials are captured and transmitted to threat actors, enabling unauthorized access to accounts, data theft, or further malicious activities like lateral movement in corporate networks. The site mimics the appearance of trusted login interfaces, often using cloned branding and convincing URLs to deceive users into submitting sensitive information. Analysis indicates this domain was created on March 28, 2026, and registered through REGRU-RU, a registrar frequently associated with malicious infrastructure. VirusTotal detection shows 5 out of 95 security vendors flagging the domain as malicious, with additional confirmation from one threat intelligence pulse on AlienVault OTX and inclusion on one security blocklist. The domain previously resolved to the IP address 145.249.115.222, which may have hosted other phishing or fraudulent content. Despite its current offline status, the domain remains a documented threat due to its historical activity and association with credential harvesting operations. Users who visited slon-4--at.ru or entered credentials on this site should assume their login details have been compromised. Immediate actions include changing passwords for any accounts accessed through the site, enabling multi-factor authentication where available, and monitoring accounts for unusual activity. If corporate credentials were exposed, notify internal security teams to assess potential risks of unauthorized access. Devices used to visit the site should be scanned for malware, as phishing pages may deploy additional payloads. Organizations should block the domain and its associated IP address in network security controls to prevent future access attempts.