slon-rest[.]ru

This domain, slon-rest.ru, operates as a fraudulent restaurant reservation portal designed to harvest user credentials and payment details under the guise of booking a table at the restaurant 'Слон.' The site mimics legitimate reservation services, presenting a convincing interface in Russian with the page title 'Бронировать стол в ресторане "Слон,"' which translates to 'Book a table at the restaurant "Elephant."' Analysis indicates the site is engineered to capture sensitive information entered by victims, including personal contact details and financial data, likely for subsequent unauthorized transactions or identity fraud. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain was registered on March 28, 2026, through the registrar RU-CENTER, a common choice for domains involved in regional phishing campaigns. It resolves to the IP address 176.57.65.84 and is currently flagged by 3 out of 95 security vendors on VirusTotal, indicating detection by a minority of engines but sufficient to confirm malicious intent. The domain appears on one security blocklist and is referenced in a single threat intelligence pulse on AlienVault OTX. Additionally, the site employs a Let's Encrypt SSL certificate, providing a false sense of security to unsuspecting visitors. Users who visited slon-rest.ru and entered any personal or financial information should take immediate action to mitigate potential harm. All credentials entered on the site should be considered compromised and must be changed across all platforms where they were reused. Financial institutions should be notified to monitor for unauthorized transactions, and credit reports should be reviewed for signs of identity theft. The domain has since been taken offline, but users are advised to remain vigilant for follow-up phishing attempts via email or SMS, particularly those referencing restaurant reservations or account verification requests.