slon-----4---cc[.]ru

This domain, slon-----4---cc.ru, is flagged as a generic phishing site designed to harvest user credentials through a fake login portal. Analysis indicates no direct brand impersonation or cryptocurrency drainer kit association, but the infrastructure aligns with credential theft campaigns targeting unsuspecting users. The site mimics login interfaces to capture usernames, passwords, and potentially multi-factor authentication codes, which are then exfiltrated to attacker-controlled servers for further exploitation or account takeover. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 145.249.115.222 and was registered on March 28, 2026, through REGRU-RU, a registrar frequently associated with malicious domains. VirusTotal reports 6 out of 95 security vendors flagging this domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse. The domain appears on a single security blocklist, and no Google Safe Browsing (GSB) detections were recorded prior to takedown. The relatively low detection rate suggests either a targeted campaign or the use of evasion techniques to avoid widespread scrutiny. As of the latest assessment, slon-----4---cc.ru has been taken offline, likely in response to detection or enforcement actions. However, the elevated risk level persists due to the domain's recent registration and association with credential-harvesting infrastructure. Users who may have interacted with this site are advised to reset passwords for any accounts accessed during the exposure window, enable multi-factor authentication, and monitor for unauthorized activity. Organizations should update blocklists to include this domain and its associated IP to prevent future access attempts. The registrar's history of hosting malicious domains warrants continued monitoring of newly registered domains under REGRU-RU.