slona4at[.]ru

Analysis of the domain slona4at.ru indicates it was actively used for credential phishing targeting users of the Slon4.at platform. The domain, registered on March 28, 2026, through REGRU-RU, resolved to the IP address 91.236.116.22, hosted by w1n ltd in Sweden. Infrastructure analysis reveals the use of a Let's Encrypt SSL certificate (serial E7), a common choice for phishing sites due to its free and automated issuance. The page title, 'Slon4.at,' aligns with the reported scam type of credential phishing, suggesting an intent to mimic the legitimate Slon4.at service. Detection data shows the domain appeared on one security blocklist and was flagged by PhishDestroy.

VirusTotal results indicate that 4 out of 94 security vendors marked the domain as malicious, providing moderate but not universal confirmation of its threat status. AlienVault OTX recorded the domain in one threat intelligence pulse, further corroborating its association with malicious activity. As of July 22, 2026, the domain is offline, reducing immediate risk but leaving open the possibility of future reactivation or migration to new infrastructure. Defenders should treat this domain as part of a credential harvesting campaign targeting Slon4.at users.

While the exact content of the phishing page is not analyzed, the combination of page title, scam type, and detection data supports this classification. Organizations should monitor for related domains registered through REGRU-RU or hosted on the same IP range, as these may indicate follow-up campaigns. Blocking access to 91.236.116.22 and domains with similar naming patterns is recommended. If Slon4.at is a known service within your environment, alert users to the potential for credential theft and reinforce multi-factor authentication requirements.