slon2--t---o[.]ru

As of July 12, 2026, the domain slon2--t---o.ru is classified as a high-risk generic phishing domain. This domain is currently active and has been flagged by PhishDestroy, indicating a potential threat to users and organizations. The domain appears on one known security blocklist, which suggests that it has been identified as part of a phishing campaign. Infrastructure analysis reveals that the domain is registered through REGRU-RU and was created on March 11, 2026. The nameservers used are elijah.ns.cloudflare.com and emely.ns.cloudflare.com, both of which are Cloudflare nameservers, commonly used for domain management. The domain resolves to the IP address 198.13.158.7, which is located in the Netherlands and is part of the AS399629 network, known for hosting various types of web content. The HTTP status code 302 indicates that the domain is likely redirecting traffic to another URL, a common technique used in phishing campaigns to deceive users into visiting malicious sites. Gridinsoft's trust score for this domain is 0 out of 100, which is a strong indicator of its malicious nature. While the domain is currently active, it is unclear what specific type of phishing content or payload it is delivering, as the page title suggests a legitimate business in equipment supply for logistics and cargo terminals. However, the low trust score and presence on a security blocklist should be taken seriously by defenders. It is recommended that organizations block this domain at the network level and educate users about the risks of visiting unfamiliar or suspicious websites. Regular monitoring of network traffic and user activity can help detect and prevent potential phishing attacks. Additionally, defenders should consider implementing multi-factor authentication and other security measures to protect against credential theft, which is a common objective of phishing campaigns.