slon4-------cc[.]ru

Analysis indicates that slon4-------cc.ru (also referenced as slon4.cc) is an active phishing domain targeting Russian-speaking users under the guise of a locksmith service. The domain was registered on March 28, 2026, through RU-CENTER-RU and currently resolves to IP address 185.212.128.10. The page title, 'slon4.cc - Ремонт и установка кодовых замков | Профессиональные услуги,' suggests a fraudulent service offering for code lock repair and installation, though no specific brand impersonation is evident from the available data. The domain is flagged by multiple security sources, including PhishDestroy and BLP-Malware, and appears on two independent blocklists. A Gridinsoft trust score of 0/100 further supports its classification as malicious. The site uses a Let's Encrypt SSL certificate, a common tactic among phishing operators to create a superficial appearance of legitimacy. VirusTotal reports that 5 of 95 security vendors detect the domain as malicious, while AlienVault OTX lists it in one threat intelligence pulse, indicating prior identification in broader threat-sharing communities. No evidence currently links this domain to a known phishing kit or specific credential-harvesting framework. The exact nature of the phishing mechanism—whether it involves fake login forms, payment redirection, or malware distribution—remains unconfirmed due to limited visibility into the site's operational content. Defenders should treat this domain as high-risk infrastructure and implement blocking measures at the DNS or network level. Further investigation into associated IP ranges and registration patterns may reveal additional connected domains.