slon3-a---t[.]ru

Analysis of the domain slon3-a---t.ru indicates it is an active credential phishing site with high-risk classification. Registered on March 28, 2026, through a Russian registrar, the domain currently resolves to IP address 172.67.209.156, which is behind Cloudflare infrastructure, as evidenced by detected technologies including Cloudflare Browser Insights and HTTP/3. The page title explicitly references 'slon1.at', suggesting an attempt to impersonate or exploit that legitimate domain. SSL certification is provided by Let's Encrypt, a common tactic to lend superficial legitimacy to malicious sites. The domain is flagged by 2 independent security blocklists and appears in 22 threat intelligence pulses on AlienVault OTX, indicating widespread recognition as malicious. Five of 95 security vendors on VirusTotal have detected this domain, though the specific nature of detections remains unconfirmed. No known phishing kit or targeted brand beyond the referenced 'slon1.at' page title has been identified in available intelligence. The domain remains active as of July 12, 2026, with no signs of takedown or mitigation. Defenders should treat this domain as a confirmed phishing threat. Recommended actions include blocking DNS resolution to 172.67.209.156, adding the domain to web proxy and email filtering deny lists, and monitoring for connections to this IP or domain within internal networks. Further analysis of the site's content may reveal additional indicators or targeted credentials, but current evidence supports immediate containment measures.