slon-9to[.]ru

Analysis of the domain slon-9to.ru indicates an active phishing infrastructure observed as of July 29, 2026. The domain was registered through REGRU-RU on February 22, 2026 and resolves to the Cloudflare‑hosted address 172.67.202.75. Its authoritative name servers are listed as dante.ns.cloudflare.com and mckinley.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The domain appears on a single security blocklist and is specifically listed by PhishDestroy, demonstrating that at least one anti‑phishing feed has identified it as malicious.

VirusTotal scans show that five of ninety‑one security vendors have flagged the domain, providing additional independent corroboration of its suspicious nature. The limited detection footprint suggests a relatively new campaign that may rely on shared hosting to evade rapid takedown. The use of Cloudflare's CDN may provide TLS termination and hide the true origin server, complicating forensic attribution. No public intelligence such as a page title, brand target, or malware kit has been disclosed, leaving the exact phishing lure undefined.

Defenders should block the domain and its resolving IP address at network perimeter devices, add the domain to local blocklists, and monitor DNS queries for the associated Cloudflare name servers. Continuous re‑scanning with multi‑engine services is recommended to capture any escalation in vendor detections, and threat‑intel feeds should be refreshed to capture further blocklist entries as the campaign matures. Because the registrar information is public, law‑enforcement requests can be directed to REGRU‑RU for potential domain suspension. Until further content analysis is available, security teams should assume the site attempts to harvest user credentials and treat any links to the domain as malicious.