slon4---a---t[.]ru

The domain slon4---a---t.ru was registered through the REGRU-RU registrar on March 20, 2026. Infrastructure analysis shows that the domain resolves to the IP address 198.251.84.254 and is served by Cloudflare name servers courtney.ns.cloudflare.com and nikon.ns.cloudflare.com. The domain appears on one security blocklist and has been actively flagged by the PhishDestroy sinkhole, confirming its current operational status. VirusTotal scans report that 13 out of 91 security vendors have identified the domain as malicious, indicating a moderate level of detection consensus across the scanning community.

The risk rating assigned is elevated, reflecting the potential impact of the observed activity. No public page title, SSL certificate details, or HTTP response codes are available in the current intelligence set, leaving the exact content and landing page behavior unverified. Consequently, analysts cannot confirm the specific brand or service being spoofed, and the site is classified only as a generic phishing infrastructure.

Defensive recommendations include immediate blocking of the domain at perimeter defenses, updating URL filtering and DNS sinkhole rules to include the resolved IP and associated name servers, and continuous monitoring of any future resolution changes. Organizations should also consider adding the domain to internal blocklists and sharing the indicator set with threat intelligence platforms to improve community-wide detection. Given the elevated risk and active blocklist presence, proactive mitigation is advised to prevent credential harvesting or related phishing exploitation.