slon-at3[.]ru

Analysis of slon-at3.ru indicates it is an active generic phishing infrastructure observed as of July 29, 2026. The domain was registered on March 18, 2026 through the registrar REGRU-RU and resolves to the IP address 188.114.97.3, which is hosted on Cloudflare infrastructure using the nameservers sureena.ns.cloudflare.com (listed twice) and woz.ns.cloudflare.com. VirusTotal reports a single positive detection among 91 security vendors, confirming that at least one vendor has identified malicious behavior associated with the domain.

The domain also appears on one external blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of its malicious intent. No additional public intelligence such as page title, SSL certificate details, HTTP response codes, or branded content has been disclosed, leaving the exact phishing payload and target brand undefined. The limited detection footprint—one vendor flag and a single blocklist entry—suggests that the campaign may be in an early deployment stage or operating with a low profile to avoid broader detection.

Defenders should prioritize adding slon-at3.ru to internal block or DNS sinkhole lists, enforce outbound traffic monitoring to the associated IP 188.114.97.3, and watch for any communication patterns that match known Cloudflare edge nodes. Continuous re‑evaluation is advised, as further sampling by additional security products could raise the detection count, and future investigations may reveal the specific credential‑harvesting technique employed. Organizations should also consider sharing any observed traffic or logs with threat‑intelligence communities to accelerate collective detection of this emerging phishing operation.