slon6-to[.]ru

Analysis of slon6-to.ru shows the domain was registered on February 22, 2026 through the REGRU-RU registrar. The authoritative name servers are dante.ns.cloudflare.com (listed twice) and mckinley.ns.cloudflare.com, indicating the use of Cloudflare’s DNS service. DNS resolution points to the IP address 188.114.97.3, which is part of Cloudflare’s network and commonly leveraged by threat actors to hide the true hosting location. VirusTotal has recorded four detections out of ninety‑one submitted security scanners, confirming that multiple AV engines have flagged the domain as malicious.

The domain also appears on a single external blocklist and is actively blocked by the PhishDestroy feed, reinforcing its classification as a phishing infrastructure. The risk rating is elevated and the operational status is listed as active. No publicly available page title, SSL certificate details, or HTTP response data were supplied, so the specific brand or service being impersonated cannot be confirmed at this time. The lack of visible content prevents verification of the exact phishing kit or lure employed.

However, the combination of recent registration, Cloudflare DNS, multiple vendor detections, and inclusion on a dedicated phishing blocklist aligns with typical patterns observed in newly deployed phishing campaigns. Defenders should add 188.114.97.3 and the fully qualified domain name slon6-to.ru to outbound and inbound filtering rules, ensure that threat‑intelligence feeds ingest the PhishDestroy indicator, and monitor for any future resolution changes or additional detections. Continuous re‑scanning of the domain with sandbox and URL‑reputation services is advised to capture any evolution of the payload or landing page. Organizations that rely on email or web gateway controls should treat any traffic to this domain as malicious until the domain is definitively retired.