slon----4-----at[.]ru

This domain, slon----4-----at.ru, is flagged as a credential harvesting phishing infrastructure designed to deceive users into submitting login credentials, financial details, or other sensitive information. Analysis indicates the site likely employed spoofed login portals mimicking legitimate services, such as banking platforms, email providers, or corporate authentication pages, to capture user input. The domain’s structure, including obfuscated subdomains and atypical character patterns, aligns with common phishing tactics to evade detection and complicate takedown efforts. Infrastructure analysis reveals the domain was registered through REGRU-RU on March 28, 2026, and resolved to the IP address 145.249.115.222. Security vendors flagged the domain in 6 out of 95 VirusTotal scans, while AlienVault OTX recorded its presence in one threat intelligence pulse. The domain appeared on a single security blocklist prior to being taken offline. Despite its current inactive status, historical resolution data and registration details suggest it was part of a broader phishing campaign targeting users in regions where the registrar’s services are commonly utilized. Users who visited slon----4-----at.ru or entered credentials on any page associated with this domain should assume their information has been compromised. Immediate actions include resetting passwords for all accounts accessed from the same device or network during the exposure window, enabling multi-factor authentication where available, and monitoring financial statements for unauthorized transactions. Organizations should review logs for connections to 145.249.115.222 or the domain itself and consider revoking session tokens for potentially affected accounts. Given the elevated risk level, affected users are advised to conduct a full security review of their systems to rule out further compromise.