slon4c----c[.]ru

PhishDestroy has identified slon4c----c.ru as a confirmed generic phishing threat, elevated risk, now offline. The page title referenced slon4.cc — an author perfumery and custom aromas site based in Moscow, indicating the phish likely impersonated a legitimate perfume brand to harvest personal or payment data. No specific drainer kit was identified in the intelligence, but the site's design aimed to deceive visitors into believing they were on an authentic e-commerce platform.

Technical indicators underscore the threat's credibility. VirusTotal flagged the domain with 2 out of 95 security vendors, while AlienVault OTX noted its presence in one threat intelligence pulse. The domain was registered on March 28, 2026, through FE-RU, and resolves to IP address 178.20.45.8. It appears on one security blocklist, and its SSL certificate was issued by Let's Encrypt (E8), adding a veneer of legitimacy. However, Google Safe Browsing status was not explicitly provided, but the domain's inclusion in blocklists and VT detections confirms malicious intent.

The domain has been taken offline as of the latest check, but residual risks remain. Users who visited the site or submitted information should monitor accounts for unusual activity and consider changing passwords. PhishDestroy recommends always verifying URLs before entering sensitive data. Although the domain is inactive, similar variants may appear, so vigilance against perfume-related phishing is advised.