slon-8-to[.]ru

The domain slon-8-to.ru has been identified as a credential phishing site targeting users through fraudulent login interfaces. Analysis indicates the domain is currently offline, though it previously operated as an active phishing endpoint. No specific brand impersonation has been confirmed, but the infrastructure aligns with generic credential harvesting campaigns. Infrastructure analysis reveals the domain was registered through REGRU-RU on March 28, 2026, and resolved to the IP address 95.163.244.138. Security vendors flagged the domain in 3 of 95 VirusTotal scans, while threat intelligence platforms recorded its presence in 1 AlienVault OTX pulse. The domain appears on 1 security blocklist, and third-party trust scoring systems assigned it a risk score of 0 out of 100. Automated detection systems previously blocked access to the domain due to confirmed phishing activity. Current assessment confirms slon-8-to.ru is offline, though residual risk remains due to the domain's registration persistence. Organizations should ensure DNS filtering systems block resolution attempts to 95.163.244.138 and the domain itself. Security teams are advised to review logs for prior connections to this endpoint, particularly from March 2026 onward. If the domain reactivates, immediate takedown procedures should be initiated through the registrar, REGRU-RU, citing its established phishing classification.