slon4--------at[.]ru

Analysis indicates that the domain slon4--------at.ru was registered on March 20, 2026 through the REGRU-RU registrar. The authoritative name servers are courtney.ns.cloudflare.com (listed twice) and nikon.ns.cloudflare.com, confirming that the domain is hosted on Cloudflare’s DNS infrastructure. DNS resolution points to the IPv4 address 198.251.84.254, which is the sole host observed for this indicator. VirusTotal reports that 13 of 91 security vendors have flagged the domain, demonstrating a moderate level of consensus among scanning engines that the site is malicious.

The domain is currently listed on one public security blocklist and has been actively blocked by the PhishDestroy service, indicating that downstream filtering platforms have already taken mitigation steps. No publicly available page title, SSL certificate details, or HTTP response codes have been released for this host, so the exact content and visual presentation remain unknown. Consequently, the specific brand or service being spoofed cannot be confirmed at this time. The lack of visible branding information limits the ability to attribute the campaign to a particular target, but the classification as a generic phishing operation is supported by the threat type label and the presence of multiple vendor detections.

Defenders should add 198.251.84.254 to network‑level deny lists, enforce DNS blocking for slon4--------at.ru, and ensure that any web‑proxy or secure web‑gateway solutions reference the latest blocklist entries that include this domain. Continuous monitoring of Cloudflare name‑server changes is advised, as attackers may shift hosting to evade detection. Organizations using email or credential‑capture filters should update rule sets to flag URLs containing the domain string. Incident response teams should treat any traffic to this host as potentially malicious and isolate affected endpoints for forensic analysis.