slon--4----at[.]ru

This domain is flagged as a credential harvesting site designed to mimic legitimate login pages. Analysis indicates it targets users through deceptive emails or messages, redirecting them to slon--4----at.ru to capture usernames, passwords, and other sensitive authentication details. The site employs generic phishing tactics, likely using cloned HTML forms to trick victims into submitting credentials, which are then exfiltrated to attacker-controlled infrastructure. Infrastructure analysis reveals the domain was registered on March 28, 2026, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 145.249.115.222, which has been linked to other phishing campaigns. Detection data shows 3 out of 95 security vendors on VirusTotal flag this domain as malicious, and it appears on one security blocklist. Additionally, the domain is referenced in one threat intelligence pulse on AlienVault OTX, further corroborating its malicious nature. If a user visited slon--4----at.ru or entered credentials on the site, immediate action is required. First, reset all passwords associated with accounts that may have been exposed, prioritizing email, financial, and work-related credentials. Enable multi-factor authentication where available to mitigate unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or transactions, and report any anomalies to the respective service providers. Users should also scan their devices for malware, as phishing sites may distribute additional payloads. Finally, report the domain to local cybersecurity authorities or threat intelligence platforms to aid in broader mitigation efforts.