webmail[.]slalom[.]himoschalet[.]fi

This domain, webmail.slalom.himoschalet.fi, is identified as a generic phishing site targeting users of Roundcube Webmail. The page title, "Roundcube Webmail :: Tervetuloa Roundcube Webmail -käyttäjäksi," directly mimics the legitimate Roundcube Webmail interface, suggesting an intent to deceive users into entering credentials. No specific drainer kit signatures were detected, but the domain’s structure and content align with credential harvesting tactics commonly used in phishing campaigns. Analysis indicates the domain was registered through Domainkeskus Oy on January 21, 2021, and resolves to the IP address 31.187.84.54, hosted under AS201964 (Domainkeskus Oy, Finland). The domain appears on two security blocklists and is flagged by 18 out of 95 security vendors on VirusTotal. The SSL certificate is issued by Let’s Encrypt (R12), which, while providing encryption, does not validate the legitimacy of the site. No detections were reported on Google Safe Browsing at the time of analysis, though this may reflect a lag in reporting rather than a clean status. The domain is currently offline, likely due to takedown actions or voluntary suspension by the hosting provider. Despite its offline status, residual risk remains for users who may have interacted with the site prior to its deactivation. Organizations are advised to monitor for credential reuse attempts and implement multi-factor authentication (MFA) to mitigate potential account compromise. Network defenders should block the IP address 31.187.84.54 and the domain at perimeter defenses, while end-users should be alerted to the phishing attempt, particularly those who may have accessed the site under the guise of Roundcube Webmail.