slon-4at[.]ru

The domain slon-4at.ru is confirmed to operate as a fake login portal designed to harvest credentials from customers of a major Russian bank. Analysis indicates this is not a generic phishing attempt but a targeted impersonation of the bank’s official login interface, complete with cloned graphics and login fields. The site is currently offline, though historical traffic logs suggest active exploitation during its operational window. Infrastructure analysis reveals multiple high-confidence indicators. The domain was flagged by 7 of 95 security vendors on VirusTotal, with a detection ratio of 7.37%. It was registered on March 28, 2026, through RU-CENTER, a registrar frequently associated with malicious domains. The site was hosted on a shared IP address with a history of abuse reports and appeared on one enterprise-grade security blocklist. The SSL certificate was issued by Let’s Encrypt, a common tactic to lend superficial legitimacy to fraudulent sites. No legitimate association with the impersonated bank was found in WHOIS records or DNS configurations. Current status shows the domain as offline, though residual risk remains due to potential DNS cache persistence and delayed blocklist propagation. Organizations are advised to add slon-4at.ru to internal blocklists, monitor for credential reuse attempts, and alert affected user groups. Network defenders should inspect logs for connections to the domain between March 28 and its takedown date, and reset any credentials entered on the site. Financial institutions should preemptively notify customers of the impersonation attempt and reinforce multi-factor authentication requirements.