slon5cc5[.]ru

Analysis indicates that the domain slon5cc5.ru was registered on 22 March 2026 through the registrar REGRU‑RU and is delegated to the standard reg.ru name servers ns1.reg.ru and ns2.reg.ru. DNS resolution points exclusively to the IPv4 address 209.141.42.45, which is the only host observed for this domain. The domain appears on a single public blocklist, where it is listed by PhishDestroy as a malicious entry.

VirusTotal has recorded six positive detections out of ninety‑one scanners, confirming that multiple security products have identified the domain as malicious. No additional intelligence such as SSL certificate details, HTTP response codes, or page title information is currently available, limiting the depth of content‑level verification. The lack of public‑facing metadata suggests that the operators rely primarily on DNS‑level indicators and blocklist listings to flag the site.

Defenders should treat the domain as an active phishing infrastructure, enforce network‑level blocking, and incorporate the IP address 209.141.42.45 into threat‑intel feeds. Continuous monitoring of the reg.ru name‑server pair and periodic re‑scans on VirusTotal or similar platforms are recommended to capture any evolution of the host’s behavior. Until further forensic evidence emerges, the observable indicators alone justify an elevated risk posture and proactive mitigation.