slon4[.]cc-at[.]ru

Analysis of the domain slon4.cc-at.ru confirms its classification as an active credential phishing site, operational as of July 12, 2026. The domain was registered on May 18, 2026, through a Russian registrar (FE-RU) and currently resolves to the IP address 216.203.20.115, hosted on infrastructure located in the Netherlands under the provider BL Networks. The site employs Cloudflare nameservers (dalary.ns.cloudflare.com and sage.ns.cloudflare.com), a common tactic to obscure hosting details and evade takedowns. The SSL certificate is issued by Let's Encrypt, a legitimate but frequently abused certificate authority, which does not mitigate the domain's malicious intent. The page title, written in Russian, translates to 'slon4.cc — online store for houseplants and care products in Moscow | Delivery across Russia.' This suggests the phishing site is designed to target Russian-speaking users, likely masquerading as a legitimate e-commerce platform to harvest credentials or financial information. The scam type is explicitly categorized as credential phishing, and the domain has been flagged by at least one security blocklist, with three out of 92 security vendors on VirusTotal detecting it as malicious. The HTTP status code 521 indicates the web server is intentionally down or misconfigured, a behavior sometimes observed in phishing campaigns to avoid automated analysis or to rotate infrastructure. Infrastructure analysis reveals the use of Nginx as the web server technology, a common choice for both legitimate and malicious sites. The domain's trust score is 0/100, reinforcing its high-risk status. Defenders should treat this domain as a confirmed threat and implement blocking measures at the DNS, IP, and certificate levels. Given the domain's recent registration and active status, monitoring for related infrastructure (e.g., newly registered domains under the same registrar or IP range) is recommended to preempt further phishing activity.