sloncc6[.]ru

The domain sloncc6.ru was registered on May 04, 2026 via the FE‑RU registrar and is currently resolved to the IP address 96.9.124.31, which maps to Romania (AS399629 BL Networks). DNS resolution is handled by Cloudflare nameservers ada.ns.cloudflare.com and salvador.ns.cloudflare.com, and the site serves content over HTTPS using a Let’s Encrypt certificate (CN=E8). An HTTP 200 response is returned and the web server identifies as Nginx. The page title – “Slon6 – Оптовые автозапчасти для грузовиков КамАЗ, МАЗ, Volvo, Scania в Москве” – indicates the site is positioned as a wholesale auto‑parts provider targeting trucks from KamAZ, MAZ, Volvo, and Scania. Threat intelligence classifies the activity as credential phishing, and the domain is flagged as high‑risk. Reputation metrics are poor: Gridinsoft assigns a trust score of 0 / 100, and VirusTotal reports five detections out of ninety‑one scanners. The domain appears on one public blocklist and has been added to the PhishDestroy blocklist. While the exact phishing payload or credential collection mechanisms have not been publicly disclosed, the available indicators suggest an active malicious infrastructure. Defenders should block the domain and associated IP at perimeter appliances, monitor DNS queries for sloncc6.ru, and enforce strict outbound filtering for traffic to the identified IP. Continuous scanning of the host for changes in content or additional malicious indicators is recommended.