slon2-cc-at[.]ru

PhishDestroy identifies slon2-cc-at.ru as an active credit-card phishing site designed to harvest payment credentials under the guise of a legitimate card service portal. The domain mimics authentic financial interfaces, presenting users with spoofed forms that request sensitive card numbers, CVV codes, and expiry dates. Once submitted, these details are transmitted to attacker-controlled servers, enabling immediate fraudulent transactions or sold on underground markets. Given the domain’s recent creation (February 21, 2026) and lack of proactive detection, its operators are actively exploiting trust in payment-related domains to bypass user vigilance. This domain was flagged with the following technical indicators: VirusTotal currently shows 0 detections out of 95 engines, indicating low signature-based detection despite active hosting. It was registered through RU-CENTER-RU and resolves to IP 89.169.183.108. The domain is less than 48 hours old, suggesting a rapid deployment tactic to evade takedowns and reputation-based filters. At the time of analysis, there are no public blocklist entries, increasing exposure for potential victims. Users who visited slon2-cc-at.ru should immediately discontinue any data entry and check browser history for unauthorized form submissions. Review all linked payment cards for suspicious transactions and contact your bank to report potential compromise. Clear browser cache and run a full antivirus scan. Avoid accessing the domain further and report it to your email provider or security team for network-wide blocking. Monitor financial statements for at least 30 days due to the high risk of credential harvesting.