5slon5-cc[.]ru

This domain, 5slon5-cc.ru, is identified as a credential harvesting phishing site targeting users through deceptive content. Analysis indicates the domain mimics a news portal, using the page title 'Почему некоторые страны меняют названия Slon5cc' to lure victims into entering sensitive information. No specific brand impersonation or drainer kit signatures were detected, but the infrastructure and content align with typical phishing campaigns designed to harvest login credentials or personal data. Infrastructure analysis reveals several critical technical indicators. The domain was registered on March 28, 2026, through REGRU-RU, a registrar frequently associated with malicious activity. It resolves to the IP address 209.141.42.45, a host previously linked to other phishing and fraudulent domains. VirusTotal reports 3 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on one security blocklist and employs Nginx as its web server technology, a common choice for phishing sites due to its flexibility and ease of deployment. As of the latest assessment, 5slon5-cc.ru has been taken offline, likely in response to security vendor interventions or hosting provider actions. However, the elevated risk persists due to the domain's recent creation date and association with known malicious infrastructure. Users who may have interacted with the site are advised to reset credentials for any accounts accessed during the exposure window. Organizations should monitor for related domains registered through the same registrar or resolving to the same IP address, as threat actors often reuse infrastructure across multiple campaigns.