slon3--cc[.]ru

The domain slon3--cc.ru has been identified as a credential harvesting phishing site designed to deceive users into submitting login credentials through fraudulent web forms. Analysis indicates this infrastructure was operational but is currently offline, with no active phishing content accessible at the time of investigation. The specific threat type involves impersonation of legitimate services to capture sensitive authentication details, though no targeted brand has been conclusively linked to this domain. Infrastructure analysis reveals the domain was registered on March 28, 2026, through RU-CENTER-RU, a registrar commonly associated with domains of Russian origin. It resolved to the IP address 172.67.162.42, a Cloudflare-hosted endpoint leveraging HTTP/3 and Cloudflare Browser Insights for performance monitoring. The domain’s SSL certificate was issued by Let’s Encrypt, a widely used certificate authority that provides encryption for both legitimate and malicious sites. Security vendors on VirusTotal flagged the domain, with 7 of 95 engines detecting it as malicious. Additionally, the domain appears on one security blocklist, specifically PhishDestroy, further corroborating its classification as phishing infrastructure. Current assessment indicates the domain is offline, with a 404 Not Found response serving as the only accessible content. While the immediate threat has been mitigated, the domain’s registration remains active, posing a residual risk of reactivation. Organizations are advised to implement DNS-based blocking for slon3--cc.ru and its associated IP address, 172.67.162.42, within network security controls. Security teams should monitor for renewed activity, particularly given the domain’s recent creation date and its use of Cloudflare, which can obscure hosting details. End-user awareness training should emphasize the risks of credential submission on unfamiliar domains, even those presenting valid SSL certificates.