slon2--c---c[.]ru

The domain slon2--c---c.ru has been identified as a credential phishing site targeting organizations in the industrial supply sector, specifically impersonating providers of water supply and sewage equipment. Analysis indicates the domain is currently offline, though prior activity suggests it was designed to harvest login credentials under the guise of a legitimate business offering industrial equipment in Moscow. No specific brand impersonation has been confirmed, but the page title and content structure align with common phishing tactics used to deceive procurement or engineering personnel. Infrastructure analysis reveals the domain was registered on March 24, 2026, through REGRU-RU, a registrar frequently associated with malicious domains. It resolves to the IP address 198.13.158.7 and has been flagged by 3 of 95 security vendors on VirusTotal. The domain appears on one security blocklist and holds a trust score of 0/100, indicating no prior legitimate reputation. Detected technologies include C, Perl, Angie, and HTTP/3, which may have been leveraged to evade detection or facilitate automated credential collection. Current status confirms the domain has been taken offline, though residual risk remains for organizations that may have interacted with it during its active phase. Recommendations include blocking the domain and its associated IP at the perimeter, reviewing logs for connections to 198.13.158.7, and conducting user awareness training on recognizing phishing attempts targeting industrial supply chains. If credentials were entered on this site, immediate password resets and multi-factor authentication enforcement are advised for affected accounts. Monitoring for similar domains registered via REGRU-RU or resolving to the same IP range is also recommended to preempt further threats.