slon--7[.]ru

The domain slon--7.ru has been confirmed as a fake login portal designed to harvest financial credentials. Analysis indicates this site impersonates banking or payment service login pages to deceive users into submitting sensitive authentication details. The domain is currently offline, though prior activity suggests it was operational for credential collection purposes. Infrastructure analysis reveals the domain was registered on March 28, 2026, through RU-CENTER, a registrar commonly associated with high-risk domains. The site employed a Let's Encrypt SSL certificate, a tactic frequently observed in phishing campaigns to create a false sense of legitimacy. Security vendors on VirusTotal flagged the domain, with 7 out of 95 engines detecting malicious activity. Additionally, the domain appears on one security blocklist, and its infrastructure was previously blocked by enterprise phishing detection systems. While slon--7.ru is currently offline, the elevated risk level persists due to the domain's historical use in credential harvesting. Organizations should maintain blocklist entries for this domain and monitor for reactivation. Users who may have interacted with the site should immediately reset credentials for any financial or sensitive accounts accessed during the exposure window. Network administrators are advised to review logs for connections to this domain and implement DNS-based blocking as a preventive measure.