slon-4---at[.]ru

PhishDestroy assesses this domain as an elevated risk, specifically a generic phishing threat targeting individuals interested in marathon training programs. The site posed as a legitimate training resource but was designed to steal personal information from unsuspecting visitors. Although it has been taken offline, the domain remains a concern due to its sophisticated appearance and low detection rate.

VirusTotal flagged this domain with only 2 out of 95 security vendors, indicating a low initial detection rate that allowed it to operate under the radar. The domain was registered through REGRU-RU on March 28, 2026, and resolved to IP address 145.249.115.222. It appeared on one security blocklist and was found in one AlienVault OTX threat intelligence pulse. The SSL certificate was issued by Let's Encrypt (E7), which added a veneer of legitimacy. The page title, "Программа тренировок для марафона от slon: бегайте быстрее и дальше at," suggests it targeted Russian-speaking users seeking marathon training plans.

Users who may have interacted with this site should change any passwords entered there immediately and monitor financial accounts for suspicious activity. Enable two-factor authentication on all important accounts. Since the domain is now offline, the immediate threat is contained, but similar phishing sites may emerge. Always verify URLs before entering personal data, and avoid clicking links in unsolicited messages offering training programs or other too-good-to-be-true deals.