sloh7[.]ru

Analysis of sloh7.ru shows an active high‑risk phishing infrastructure first observed on April 30, 2026. The domain was registered through the REGRU‑RU registrar and resolves to the Cloudflare‑hosted address 104.21.71.87, using the nameservers kristin.ns.cloudflare.com and rodrigo.ns.cloudflare.com. VirusTotal has recorded a single positive detection out of 91 security vendors, indicating that at least one scanner identified malicious behavior. The domain currently appears on one external security blocklist and has been explicitly blocked by the PhishDestroy feed, confirming that threat intelligence communities consider it malicious.

No additional public reputation services, Safe Browsing entries, or OTX tags were supplied, so the broader ecosystem visibility remains limited. The sparse detection footprint suggests a low‑profile campaign that relies on the reputation of Cloudflare’s CDN to obscure origin, a technique commonly observed in recent phishing operations. Defenders should add sloh7.ru to proxy and firewall deny lists, monitor DNS queries for the domain and its associated Cloudflare nameservers, and enforce strict email filtering for messages containing links to the domain.

Given the single vendor flag, continuous re‑scanning of the domain on multi‑engine services is advisable to capture any escalation in detection rates. Incident response teams should treat any credential or payment requests linked to this domain as malicious, isolate affected endpoints, and conduct forensic analysis to uncover potential credential harvesting. Until further intelligence becomes available, the domain should be considered hostile and blocked at the network perimeter.