slons5-cc[.]ru

Analysis indicates that slons5-cc.ru was registered on March 10 2026 via the REGRU‑RU registrar. The domain is delegated to Cloudflare name servers sureena.ns.cloudflare.com and woz.ns.cloudflare.com, resolving to the IP address 172.67.173.29, which belongs to Cloudflare’s global edge network. The domain appears on a single security blocklist and is explicitly listed by PhishDestroy as a phishing source, confirming its classification as a generic phishing site. VirusTotal scans have returned detections from 12 out of 91 security vendors, reinforcing the malicious reputation.

No additional metadata such as SSL certificate details, HTTP response codes, or page titles are available in the current intelligence set, leaving the exact content and target brand of the site unverified. At present, no evidence of SSL certificate issuance, no observed HTTP redirects, and no publicly disclosed phishing landing page have been captured, which limits attribution but does not diminish the observed malicious indicators. The limited but consistent signals—registrar information, Cloudflare hosting, blocklist inclusion, and multi‑vendor detections—are sufficient to deem the domain high‑risk for credential harvesting.

Defensive operators should add the domain and its resolved IP to network deny lists, enforce DNS‑level blocking, and monitor for any outbound connections to the IP range. Continuous re‑scanning with VirusTotal and periodic checks of security blocklists are recommended to capture any changes in detection rates or additional indicators of compromise. Until further content analysis is performed, the domain should be treated as an active phishing threat.