slon4---------cc[.]ru

The domain slon4---------cc.ru has been identified as part of a generic phishing operation. The site purports to offer handcrafted ceramics and pottery in Moscow, which may be used as a guise to lure unsuspecting victims into divulging personal information or credentials. It is not affiliated with any known brand or organization and does not appear to utilize any known drainer kits. Instead, it likely employs standard phishing techniques to deceive visitors.

Technical analysis reveals several critical indicators of compromise. The domain was detected by 6 out of 95 security vendors on VirusTotal, indicating a moderate level of recognition among threat intelligence platforms. It was registered on March 28, 2026, through the registrar FE-RU, and resolved to the IP address 178.20.45.8. The site was found in one threat intelligence pulse on AlienVault OTX and blocked by at least two security lists, namely PhishDestroy and OISD. The domain uses a Let's Encrypt SSL certificate, which is common in phishing operations due to its ease of acquisition and lack of cost.

Currently, the domain is offline, reducing the immediate risk of exposure. However, the presence of its footprint in threat intelligence platforms and blocklists suggests it had been active in malicious activities prior to being taken down. Users are advised to remain vigilant and report any suspicious activity related to similar domains. Monitoring for potential reactivation or the emergence of related domains is recommended to mitigate any residual risk. Security teams should ensure that they have robust detection mechanisms in place to identify and block phishing attempts effectively.