slon----4----at[.]ru

This domain, slon----4----at.ru, is identified as a generic phishing resource designed to harvest user credentials through deceptive login interfaces. Analysis indicates the domain mimics legitimate authentication portals, likely targeting unsuspecting users to exfiltrate sensitive information such as usernames, passwords, and potentially multi-factor authentication codes. No specific brand impersonation or drainer kit signatures have been confirmed, though the infrastructure aligns with common credential theft campaigns observed in recent threat intelligence reports. Technical indicators reveal the domain was registered through REGRU-RU on March 28, 2026, an atypical future-dated creation that may suggest registry manipulation or typo-squatting tactics. It resolves to the IP address 145.249.115.222, a host previously associated with malicious activity in threat intelligence pulses. Detection metrics show 6 out of 95 security vendors on VirusTotal flagged the domain as malicious, while it appears on a single security blocklist. No Google Safe Browsing (GSB) detections were recorded at the time of analysis, though this may reflect delayed reporting rather than benign status. The domain has since been taken offline, likely due to remediation efforts by hosting providers or registrars following abuse reports. Despite its inactive status, residual risk persists due to the potential for re-registration or migration to alternative infrastructure. Organizations are advised to monitor for related indicators, including the associated IP and registrar patterns, and implement network-level blocking for the domain and its resolved address. Users should be educated on recognizing phishing attempts, particularly those leveraging non-standard domain structures or urgent authentication prompts.