slon4--------cc[.]ru

Analysis of slon4--------cc.ru shows that the domain was registered on 28 March 2026 and presently resolves to IP 168.100.8.206, hosted in the Netherlands under the BL Networks network. The web server returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (entity E7). The page title returned by the server is encoded as “slon4 cc — кастомные академии и акваскейпинг на заказ в Москве”, indicating a Russian‑language landing page that is consistent with generic phishing campaigns. The domain appears on one public blocklist and is already flagged by PhishDestroy. Reputation services record a Gridinsoft trust score of 0 / 100 and VirusTotal reports detections by 2 of 94 scanned scanners. AlienVault OTX lists the domain in a single intelligence pulse. The combination of a recent registration, low trust score, active blocklist entries, and multiple vendor detections classifies the infrastructure as high‑risk. At present no additional infrastructure such as command‑and‑control hosts or malware payloads has been observed, and the specific target brand or credential‑harvesting kit remains unknown. Defenders should block the domain at network perimeters, monitor DNS queries for the 168.100.8.206 address, and consider adding the URL to URL filtering policies. Ongoing collection of payloads and sinkhole of associated traffic is recommended to determine the full scope of the campaign.