slon-4----a-t[.]ru

Analysis indicates that the domain slon-4----a-t.ru was registered on March 20 2026 through the Russian registrar REGRU-RU. The domain resolves to the IP address 198.251.84.254 and is served via Cloudflare DNS infrastructure, as indicated by the authoritative nameservers courtney.ns.cloudflare.com and nikon.ns.cloudflare.com. Cloudflare front‑end services can obscure the true hosting environment, complicating attribution.

At the time of this report, 12 of 91 security scanners on VirusTotal have flagged the domain as malicious, reflecting a moderate consensus among detection engines that the site is being used for abusive activity. The domain is currently listed on a single security blocklist and has been explicitly blocked by the PhishDestroy remediation service, which further corroborates its involvement in phishing campaigns.

The public evidence does not include a page title, SSL certificate details, HTTP response codes, or any Safe Browsing verdicts, so the exact content served by the site remains unknown. Likewise, no additional intelligence such as OTX references, associated malware kits, or targeted brands has been disclosed. This lack of visible payload information limits the ability to attribute a specific phishing scenario, but the detection count and blocklist presence are sufficient to treat the domain as a high‑confidence phishing indicator.

Defenders should add slon-4----a-t.ru to network and endpoint deny lists, enforce DNS sink‑hole or firewall rules to block outbound connections to the resolved IP (198.251.84.254), and monitor for any authentication attempts directed at the domain. Security teams should also watch for related infrastructure that shares the same Cloudflare nameservers or IP range, as attackers often reuse hosting assets. Continuous re‑scanning on VirusTotal and other multi‑engine platforms is recommended to capture any changes in detection status.