slon4--at[.]ru

The domain slon4--at.ru was registered on March 28, 2026 and is currently active. It resolves to the IP address 104.21.20.122, which belongs to a large content‑delivery network located in Canada. The site presents a valid TLS certificate issued by Let’s Encrypt (identifier YE1) and returns HTTP 200 responses with the page title “slon4.at”.

Open‑source threat intelligence feeds have cited the domain in 22 separate pulses, indicating repeated observation across multiple campaigns. Independent scanning platforms have flagged the site in six out of ninety‑five analyses, and a reputation scoring engine assigns it a zero‑point trust rating. The domain appears on one public blocklist and is listed by a known phishing mitigation list as blocked.

Infrastructure analysis shows that the domain relies on a shared edge network, making attribution to a single operator difficult. The recent registration date, combined with the low trust score and multiple detection events, suggests a purpose‑built deployment for credential‑harvesting rather than a legitimate service. The presence of a Let’s Encrypt certificate confirms that the operators have taken minimal steps to avoid browser warnings, a common tactic in generic phishing operations.

Defenders should add slon4--at.ru to network and email filtering rules, enforce DNS sinkholing where possible, and monitor for traffic to the associated IP range. Continuous re‑evaluation of the domain’s status is advised, as the underlying hosting provider may change the IP address or certificate without notice, potentially affecting detection efficacy.