slon1at-a[.]ru

PhishDestroy identifies slon1at-a.ru as an active credential harvesting phishing domain posing a significant risk to end users. This domain is currently under investigation for its role in mimicking legitimate login portals to steal user credentials, with no detections recorded across 95 VirusTotal engines. This low initial detection rate suggests either a recently deployed infrastructure or evasion tactics aimed at bypassing static analysis tools. The domain was registered on February 20, 2026, through REGRU-RU, a registrar known for accommodating high-risk registrations. It resolves to IP address 198.13.158.7 and currently operates under a Let's Encrypt SSL certificate to enhance perceived legitimacy. Despite its recent creation, this domain has not yet been flagged by any public blocklists, indicating a window of opportunity for malicious actors to exploit unsuspecting victims before widespread recognition occurs. This domain exhibits multiple red flags consistent with credential harvesting campaigns. The use of a free SSL certificate from Let's Encrypt is a common tactic to appear trustworthy, while the recent registration date (February 20, 2026) suggests a hastily deployed operation. The registrar, REGRU-RU, has a history of enabling cybercriminal activity, and the absence of detections on VirusTotal (2/95) highlights the need for behavioral analysis and dynamic scanning to uncover its true intent. The IP address 198.13.158.7 is associated with hosting providers frequently linked to malicious domains, further reducing the domain's trustworthiness. Given the lack of current blocklist entries, proactive measures are essential to prevent user exposure. To mitigate the risk posed by slon1at-a.ru, users and organizations should immediately block the domain at the network and endpoint levels. Security teams should update firewall rules to deny outbound connections to 198.13.158.7 and inspect DNS logs for any queries to slon1at-a.ru. Users should verify the legitimacy of any login prompts by cross-referencing the domain with official sources and enabling multi-factor authentication on all accounts. Reporting this domain to threat intelligence platforms and local CERT teams can accelerate its inclusion in blocklists. Continuous monitoring for similar newly registered domains is recommended, as attackers often cycle through short-lived infrastructure to evade detection.