slon4--c---c[.]ru

Analysis indicates that the domain slon4--c---c.ru was registered on March 18 2026 through the REGRU-RU registrar and is presently active. The domain resolves to the IP address 198.13.158.7 and is served by Cloudflare nameservers elijah.ns.cloudflare.com and emely.ns.cloudflare.com, suggesting the use of a reputable content‑delivery network to obscure the true hosting location. VirusTotal records show that two of ninety‑one security vendors have flagged the domain, providing an early indicator of malicious intent. The site has been added to a security blocklist and is specifically blocked by the PhishDestroy service, confirming that at least one anti‑phishing organization has identified it as a threat.

No additional public blocklists or safe‑browsing services are listed in the available intelligence. The limited detection footprint—only two vendor detections and a single blocklist entry—means that broader security platforms may not yet have incorporated the domain into their feeds, increasing the risk of exposure for organizations that rely on a narrow set of indicators. Because the page content, SSL certificate details, HTTP response codes, and any brand‑specific impersonation have not been disclosed, the precise phishing campaign characteristics remain uncertain. Defenders should proactively block the domain and its resolving IP address at perimeter firewalls, DNS resolvers, and endpoint protection solutions.

Continuous monitoring of the IP 198.13.158.7 for new domains or related activity is advised, as attackers frequently reuse infrastructure. Organizations should also consider adding the domain to internal threat intelligence feeds and watch for any future VirusTotal or blocklist updates that may increase the detection count. Until further forensic analysis of the hosted content is available, the precautionary measures outlined here represent the most effective mitigation against this elevated‑risk phishing infrastructure.