slon-------4at[.]ru

The domain slon-------4at.ru has been identified as a site involved in credential theft and is currently offline. This domain was specifically designed to deceive users into divulging sensitive information, likely through impersonation techniques or misleading interfaces. The domain was taken offline after being flagged as part of phishing operations, posing an elevated risk to users who might have interacted with it.

Key intelligence indicates that slon-------4at.ru was registered on March 28, 2026, through the registrar REGRU-RU. The domain resolved to the IP address 145.249.115.222. Notably, it has been flagged by 6 out of 95 security vendors on VirusTotal, indicating a significant level of detection by the cybersecurity community. Additionally, the domain appears on one security blocklist, specifically blocked by PhishDestroy, and has been mentioned in one threat intelligence pulse on AlienVault OTX. These findings underscore the potential threat posed by the domain's infrastructure.

Currently, the domain is offline, reducing immediate risk; however, vigilance is advised as similar domains may emerge. Users are recommended to update security software, be cautious of unsolicited communications, and verify URLs before providing any personal information online. Organizations should implement advanced threat detection systems to identify and mitigate such threats proactively. Continuous monitoring of threat intelligence platforms is also advised to stay informed about emerging phishing threats.