slon-----4----at[.]ru

This domain, slon-----4----at.ru, poses an elevated risk as a credential theft platform designed to harvest banking login details from unsuspecting users. Analysis indicates the site mimics legitimate financial institution portals, tricking visitors into submitting sensitive account information. Once entered, credentials are transmitted to threat actors, enabling unauthorized account access, fraudulent transactions, and potential identity theft. The domain's infrastructure and rapid takedown suggest a targeted campaign with short-term objectives, likely focused on regional or niche financial services. Infrastructure analysis reveals the domain was registered on March 28, 2026, through REGRU-RU, a registrar frequently associated with malicious activity. The domain resolves to the IP address 145.249.115.222, which has been flagged in prior threat intelligence reports. Detection metrics confirm the domain's malicious nature: it appears on one security blocklist, is flagged by 4 out of 95 security vendors on VirusTotal, and is documented in one AlienVault OTX threat intelligence pulse. The low detection count relative to vendor coverage suggests either a new or highly targeted campaign, evading broader scrutiny through limited exposure or obfuscation techniques. Users who visited slon-----4----at.ru or entered credentials on the site should take immediate action to mitigate risks. First, terminate any active sessions on the site and avoid further interaction. Change passwords for any accounts accessed or entered on the domain, prioritizing financial and email accounts. Enable multi-factor authentication where available to add an additional security layer. Monitor bank statements and transaction histories for unauthorized activity, and report suspicious transactions to the financial institution. If personal or financial data was disclosed, consider placing a fraud alert or credit freeze with relevant credit bureaus. Finally, scan local devices for malware using updated security tools to detect potential secondary infections or data exfiltration.