ScanMalware.com
Known malicious kitlowother

Brand look-alike doorway network: Russian copies of software and AI product pages funnelling to app[.]slidy[.]ai

family: slidy-brand-doorways-2026-10
Short link:scanmalware.com/h/296

Russian-language look-alike landing pages for well-known software and AI products (Google Slides, Google Docs, Microsoft Word, Excel and PowerPoint, Adobe Photoshop, Canva, CapCut, DeepSeek, Midjourney, ElevenLabs, Suno, Sora, Notion and others), registered as <brand>.com.ru, .net.ru, .org.ru, .pp.ru and .ru.net with one brand per IP address. The pages present themselves as the product without saying they are unofficial. Every "Try" button goes through the site's own /go/ path to the sign-up page of an AI subscription service (app[.]slidy[.]ai) whose trial renews automatically. No credential form or file download has been observed: this is deceptive marketing, not credential phishing or malware.

Anchors

SMQL queryrun
yara_rule:Slidy_Brand_Lookalike_Doorway OR ip:89.223.7.98 OR ip:89.223.7.99 OR ip:89.223.7.100 OR ip:89.223.7.101 OR ip:89.223.7.102 OR ip:89.223.7.103 OR ip:89.223.7.104 OR ip:89.223.7.105 OR ip:89.223.7.106 OR ip:89.223.7.107 OR ip:89.223.7.108 OR ip:185.216.195.238 OR ip:195.133.194.147 OR ip:2.26.121.188 OR ip:2.26.121.210 OR ip:153.76.163.103 OR ip:94.139.248.142 OR tracking_id:112969169 OR tracking_id:113595845

Provenance

Added: 2026-10-17 16:35
Tracking hunt. It matches pages that carry the network's shared cross-site link block and /go/ routing hooks, and pages served from the network's hosting addresses.
References:

Sightings (50)Atom feed

HostScanScriptMatchScanned
notion.net.ru59c549eb…—query2026-10-17 16:17
wan-ai.net.ru4a878349…—query2026-10-17 16:17
grok.net.rufbd19e08…—query2026-10-17 16:17
udio.net.rub8bfa31d…—query2026-10-17 16:17
moises.net.ru02d7b3e4…—query2026-10-17 16:17
voicemod.net.ruab12ca34…—query2026-10-17 16:17
myheritage.net.ru76322ce2…—query2026-10-17 16:17
alightmotion.net.ru0243d6b4…—query2026-10-17 16:17
inshot.net.ru9e87fcfe…—query2026-10-17 16:17
pika.net.rufe1ad9a6…—query2026-10-17 16:17
powerpoint.fit5fd647ef…—query2026-10-17 16:17
neurosphere.net.rue04eb9e1…—query2026-10-17 16:17
neuroslide.net.rub35ab99d…—query2026-10-17 16:17
kimi.net.rufbe8a628…—query2026-10-17 16:16
kling-ai.pp.ru7b2da074…—query2026-10-17 16:16
otvety-ai.ru211703f1…—query2026-10-17 16:16
notebooklm.net.ru82187dfb…—query2026-10-17 16:16
qwen.net.ruaa55cf41…—query2026-10-17 16:16
leonardo-ai.net.ru210a8aa4…—query2026-10-17 16:16
higgsfield.net.ru2914f715…—query2026-10-17 16:16
sora.net.ru3a5643a6…—query2026-10-17 16:16
suno-ai.net.ru3da4b396…—query2026-10-17 16:16
runway.net.ru126e65d6…—query2026-10-17 16:16
nano-banana.net.ru8d428c9e…—query2026-10-17 16:16
gemini.pp.ru6d5c16cb…—query2026-10-17 16:16
perplexity.net.ru35cef2ac…—query2026-10-17 16:16
tekst-dlya-lendinga.rub9f88f9e…—query2026-10-17 16:16
email-generator.ruffb56a14…—query2026-10-17 16:16
analiticheskaya-zapiska.ru13d09fd9…—query2026-10-17 16:16
noviy-document.ru3a3cffae…—query2026-10-17 16:16
konspekt-generator.ruf828c68e…—query2026-10-17 16:16
referat-generator.rudc7eed55…—query2026-10-17 16:16
esse-generator.ruc07d6b0f…—query2026-10-17 16:16
gamma.pp.ru9b0d43e4…—query2026-10-17 16:16
elevenlabs.net.ru730033ef…—query2026-10-17 16:16
heygen.net.rua6627f5f…—query2026-10-17 16:16
beatiful-ai.pwb5861d6e…—query2026-10-17 16:16
deepmindgoogle.net.ru12279125…—query2026-10-17 16:08
midjourney.net.rucbf066a0…—query2026-10-17 16:08
deepseek.net.ru3ba07512…—query2026-10-17 16:08
docs-google.net.ru2c1e9844…—query2026-10-17 16:08
canva.net.ru4893802c…—query2026-10-17 16:08
capcut.net.ru6e581ba0…—query2026-10-17 16:08
libreoffice.net.ru22430851…—query2026-10-17 16:08
excel.net.ru9b1b5642…—query2026-10-17 16:08
word.net.rud09b8ede…—query2026-10-17 16:08
photoshop.net.rue9cff669…—query2026-10-17 16:08
workspacegoogle.net.rua863688a…—query2026-10-17 16:01
workspacegoogle.pp.ru574b5d25…—query2026-10-17 16:01
workspacegoogle.org.ru0eedd00c…—query2026-10-17 16:01