slon5at[.]ru

Analysis on July 29, 2026 indicates that the domain slon5at.ru was registered through the Russian registrar REGRU-RU on February 18, 2026. The domain is currently resolving to the IP address 172.67.211.193, which is part of the Cloudflare network and is served by the authoritative nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com. The infrastructure choice is consistent with a pattern of fast‑flux or proxy‑based hosting often employed by phishing operators to hide origin. Threat intelligence records show that the domain has been added to a single security blocklist and is actively blocked by the PhishDestroy service.

VirusTotal scans report that two out of ninety‑one antivirus or URL‑reputation engines have flagged the domain as malicious, confirming a non‑trivial detection rate. No additional public reputation services, such as Google Safe Browsing or OTX, are referenced in the available data. The classification of the site is a generic phishing campaign, implying that the domain is likely being used to harvest credentials or personal information. Concrete evidence beyond the registration, hosting, and detection metrics is not presently available; page content, SSL certificate details, HTTP response codes, and any observed phishing lure have not been disclosed.

Consequently, the full scope of the campaign, including targeted brands or lure techniques, remains uncertain. Defenders should continue to block the domain at network perimeter devices, update URL filtering lists, and monitor outbound connections to the 172.67.211.193 address. Adding the domain to internal blocklists, as well as informing users about the recent registration date and association with PhishDestroy, can reduce exposure. Ongoing observation of the Cloudflare IP range for additional malicious domains is recommended, and any future detection from additional vendors should be incorporated into incident response workflows.