slon4c-c[.]ru

PhishDestroy has identified the domain slon4c-c.ru as a generic phishing threat, posing as a legitimate laser engraving and cutting service in Moscow under the title "slon4.cc — лазерная гравировка и резка на заказ в Москве." No specific brand or drainer kit was associated with this domain, but its deceptive appearance suggests an attempt to harvest credentials or sensitive information from users seeking such services. The domain was registered on March 28, 2026, giving it a very short lifespan before it was taken offline.

Technical analysis reveals several red flags: VirusTotal reports that 2 out of 95 security vendors flag this domain as malicious, indicating a moderate but not overwhelming consensus among security products. The domain was found on one security blocklist and appears in one AlienVault OTX threat intelligence pulse. It resolves to IP address 168.100.8.206 and uses an SSL certificate issued by Let's Encrypt (E7), which is commonly abused by phishing sites due to its free and automated issuance. The domain's Google Safe Browsing status is not provided, but its appearance on a blocklist suggests it may have been flagged for malicious activity.

As of the latest check, slon4c-c.ru is offline, a positive indicator that some action has been taken to disrupt the threat. However, the domain's registration date being so recent and its presence on threat intelligence feeds suggest that the infrastructure may be reactivated under a different domain or IP. Users who have interacted with this site should monitor for suspicious activity, change passwords, and enable multi-factor authentication. PhishDestroy recommends blocking the domain at the network level and adding the IP 168.100.8.206 to threat lists. Continued vigilance is advised as the actors behind this phishing campaign may pivot to new domains.