slon------4------cc[.]ru

PhishDestroy has assessed the domain slon------4------cc.ru at an elevated risk level, classifying it as a credential phishing threat. This site was designed to deceive users into submitting sensitive login information, a common tactic in targeted phishing campaigns. The domain is now offline, but its infrastructure and indicators provide critical insight into the threat landscape.

Technical analysis reveals that the domain was created on March 28, 2026, through the registrar REGRU-RU, and resolved to IP address 145.249.115.222. VirusTotal flagged it with 2 out of 95 security vendors marking it as malicious, and it appears on 1 security blocklist. AlienVault OTX also detected it in 1 threat intelligence pulse. The site used a Let's Encrypt SSL certificate (E8), which is often abused by phishers due to its free and automated issuance. These data points collectively confirm the domain's malicious intent.

To protect against credential phishing, users should avoid entering login credentials on any site that arrives via unsolicited links, especially those with unusual domain structures like this one. Enable multi-factor authentication on all accounts, use a password manager to detect lookalike domains, and report any similar suspicious domains to security teams. PhishDestroy recommends blocking this domain and its associated IP across networks to prevent future access.