slon--3[.]ru

Analysis of slon--3.ru indicates an active generic phishing infrastructure. The domain was registered through RU-CENTER-RU on 28 March 2026 and points to the IP address 188.114.97.3, which is owned by Cloudflare, Inc. (CA). DNS resolution uses Cloudflare’s authoritative nameservers ashley.ns.cloudflare.com and marty.ns.cloudflare.com. The site serves an HTTPS certificate issued by Let’s Encrypt (subject YE2) and negotiates HTTP/3, with Cloudflare Browser Insights detected. An HTTP request returns status 200 while the page title reported is “404 Not Found”, suggesting the landing page may be hidden or dynamically generated. Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, the domain appears on one security blocklist and is listed by PhishDestroy. VirusTotal scans show 7 of 94 security vendors flag the domain as malicious. The combination of recent registration, Cloudflare‑proxied hosting, low trust scores, and multiple vendor detections supports a high‑risk classification. At present no specific brand or credential‑harvesting page has been observed, so the exact phishing payload remains unknown. Defenders should block the domain at network and endpoint layers, monitor DNS queries for the associated IP and nameservers, and consider adding the domain to internal blacklists while continuing to watch for any evolving content.