slon4---cc[.]ru

slon4---cc.ru is an active domain that has been classified as a generic phishing site with an elevated risk rating. The domain was created on March 06, 2026 and is registered through the REGRU-RU registrar. Its authoritative DNS servers are ns1.reg.ru, ns1.reg.ru., ns2.reg.ru, and ns2.reg.ru. Resolution points to the IPv4 address 205.185.113.136, which is currently listed on the PhishDestroy blocklist and appears on one additional security blocklist.

VirusTotal analysis shows that three of ninety‑one scanning engines have flagged the domain as malicious, indicating partial consensus among security vendors. The domain is presently listed as active in the intelligence feed, and its unique seed identifier is 33f777. The available evidence confirms that the infrastructure is deliberately hosted to support phishing operations, but no public page content, SSL certificate details, or HTTP response codes have been disclosed. Consequently, the exact payload or credential‑harvesting mechanisms remain unknown.

Defenders should block any outbound or inbound traffic to 205.185.113.136 and add slon4---cc.ru to local DNS deny lists. Continuous monitoring of the registrar REGRU‑RU and the associated nameservers is advised, as changes may indicate further campaign expansion. Correlation with other detections that reference the same IP or blocklist entries can help identify related malicious actors. Given the limited vendor agreement (3/91) and the domain’s recent creation, rapid response is recommended to mitigate potential phishing attempts before broader adoption.