slon-4------at[.]ru

This domain, slon-4------at.ru, is flagged as a credential theft phishing site designed to harvest user login credentials through deceptive login portals. Analysis indicates no direct association with a specific brand or cryptocurrency drainer kit, though the infrastructure aligns with credential harvesting campaigns targeting generic webmail, social media, and financial service logins. The domain exhibits characteristics typical of low-effort phishing operations, including obfuscated subdomains and rapid deployment cycles. Infrastructure analysis reveals the domain was registered on March 28, 2026, through REGRU-RU, a registrar frequently observed in phishing campaigns due to its permissive registration policies. The domain resolves to the IP address 145.249.115.222, which has been linked to other malicious activities in recent threat intelligence reports. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on one additional security blocklist. The domain was also identified in a single threat intelligence pulse on AlienVault OTX, further corroborating its malicious classification. Google Safe Browsing (GSB) does not currently list the domain, though this may reflect a delay in propagation rather than a clean status. The domain has since been taken offline, likely in response to detection and blocking by security systems. However, the infrastructure remains a residual risk, as threat actors may redeploy the domain or repurpose the IP address for future campaigns. Users who interacted with the domain are advised to reset credentials for any accounts accessed during the exposure window, particularly if multi-factor authentication was not enabled. Organizations should monitor network logs for connections to 145.249.115.222 and consider blocking the IP at the perimeter to mitigate potential follow-up attacks. The elevated risk level persists until the domain registration is fully revoked or the hosting infrastructure is dismantled.