slon4---at[.]ru

The domain slon4---at.ru is currently listed as active and poses an elevated risk, primarily associated with generic phishing activity. Technical analysis confirms that this domain is flagged by PhishDestroy and appears on one recognized security blocklist, indicating that automated threat intelligence platforms have detected malicious or suspicious behavior. VirusTotal reports that 5 out of 91 security vendors have identified this domain as problematic, further supporting the assessment of elevated risk. The domain is registered through REGRU-RU, a common registrar, and utilizes nameservers ns1.reg.ru and ns2.reg.ru, which are typical for domains registered with this provider.

The domain resolves to IP address 205.185.113.136. There is no evidence provided regarding SSL configuration, HTTP status, or content analysis, so the specific nature of the phishing attempt, targeted brands, or page content remains undetermined based on current data. The domain was created on March 06, 2026, suggesting it is relatively new and may have been registered specifically for malicious use, as is common with phishing infrastructure.

Defenders should block or closely monitor traffic to slon4---at.ru and the associated IP address, and consider updating security filters to reflect its inclusion on threat blocklists. Continued monitoring for changes in detection rates or emerging evidence is recommended, as the domain remains active and may evolve its tactics. No further details about the phishing campaign or targeted entities are available at this time.