slon--5cc[.]ru

Analysis as of July 29, 2026 indicates that the domain slon--5cc.ru was registered through the Russian registrar REGRU-RU on March 22, 2026. The domain resolves to the IPv4 address 209.141.42.45 and uses the registrar‑provided name servers ns1.reg.ru and ns2.reg.ru. The infrastructure is currently listed on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole, confirming that it is being used in a malicious campaign. VirusTotal reports that three out of ninety‑one scanning engines have flagged the domain, which aligns with its classification as a generic phishing site.

The risk rating assigned by the internal tier is elevated, and the domain’s status is marked as active, meaning the malicious infrastructure is still operational. Publicly available data does not include a page title, SSL certificate details, HTTP response codes, or any observed brand targeting, limiting the ability to describe the specific phishing lure employed. Consequently, the exact content served by the site remains unverified, and analysts should treat any interaction with the domain as potentially unsafe.

Defenders are advised to add 209.141.42.45 and the domain slon--5cc.ru to outbound and inbound filtering rules, monitor DNS queries for the domain, and ensure that any internal security tooling that references blocklist feeds incorporates the observed entry. Ongoing observation of the domain’s resolution and any future VirusTotal scans should be logged to detect changes in detection coverage. Given the confirmed registration details, blocklist inclusion, and partial VirusTotal detection, the domain should be considered a high‑confidence phishing indicator pending further content analysis.