www-slon3at[.]ru

Analysis of www-slon3at.ru indicates a high‑risk generic phishing operation that remains active as of 12 July 2026. The domain was registered on 28 March 2026 and resolves to the IPv4 address 5.23.52.13, which is hosted by JSC “TIMEWEB” in Russia. The web server returns HTTP 200 and presents a page titled “slon3.at Вход через капчу SLON”, suggesting a login portal protected by a captcha. The site uses a Let’s Encrypt certificate (issuer E8) and yields a Gridinsoft trust score of 0 out of 100, reinforcing its malicious nature. Threat intelligence sources reinforce the malicious assessment. The domain appears on a single security blocklist and has been blocked by PhishDestroy. AlienVault OTX lists the domain in 22 separate threat pulses, and VirusTotal reports that 1 of 95 scanned security vendors flagged the domain as malicious. These indicators collectively confirm that the infrastructure is being leveraged for credential‑harvesting attempts. While the available data clearly demonstrates phishing activity, certain details remain unknown. The specific phishing kit or credential‑collection backend has not been publicly disclosed, and the target brand or service being impersonated is not evident from the page title alone. No additional IPs or hosting variations have been observed, limiting the scope of the current infrastructure mapping. Defenders should treat www-slon3at.ru as hostile and block all network traffic to the domain and its resolved IP address. Email gateways should be configured to flag messages containing URLs that resolve to 5.23.52.13 or that reference the observed page title. Continuous monitoring of threat feeds for new pulses related to this domain is advised, and incident response teams should be prepared to investigate compromised credentials that may originate from this site.