sloni5[.]ru

Analysis indicates the domain sloni5.ru operates as a credential theft platform designed to harvest financial account logins. The site employs cloned interfaces of major banking institutions, tricking users into submitting sensitive authentication details such as usernames, passwords, and multi-factor authentication codes. Once captured, these credentials are typically exfiltrated to attacker-controlled infrastructure for immediate unauthorized access or sold on underground markets. The campaign appears targeted, with localized language elements and region-specific branding observed in captured samples. Infrastructure analysis reveals the domain was registered on March 28, 2026, through an unidentified registrar, with a Let's Encrypt SSL certificate providing HTTPS encryption to appear legitimate. Detection metrics show 7 out of 95 security engines on VirusTotal flagged the domain as malicious at the time of assessment. The domain appears on one security blocklist, suggesting limited but confirmed distribution. The creation date discrepancy (2026) indicates potential domain spoofing or incorrect WHOIS records, a common tactic to evade temporal-based detection systems. Users who visited sloni5.ru should immediately revoke any entered credentials by resetting passwords through official banking portals. Multi-factor authentication tokens used on the site should be invalidated and replaced. Device scans using updated security tools are recommended to detect potential secondary infections. Financial institutions should be notified of potential account compromise, and transaction monitoring should be enabled for unusual activity. The domain's current offline status does not preclude future reactivation; users should remain vigilant for similar phishing attempts through email or messaging platforms.