slon----4------at[.]ru

This domain is flagged for elevated risk due to generic_phishing activity classified as fake brand impersonation. Analysis indicates the domain mimics a legitimate theater platform, presenting itself as a source for theatrical performances and events under the guise of "Slon2 at." The intent appears to deceive users into engaging with fraudulent content, potentially leading to credential harvesting or malware distribution. Infrastructure analysis reveals the domain was registered through REGRU-RU on March 28, 2026, and currently resolves to the IP address 145.249.115.222. VirusTotal reports 6 out of 95 security vendors flagging the domain as malicious. The domain appears on one security blocklist and is associated with a single threat intelligence pulse in AlienVault OTX. Detected technologies include PHP, Debian, Apache HTTP Server, and HTTP/3, suggesting a structured web hosting environment. The domain was taken offline, but residual risk remains due to its prior activity. Mitigation steps for this type of threat include blocking the domain and its associated IP (145.249.115.222) at the network perimeter. Organizations should update endpoint protection rules to detect and prevent access to the domain. Security teams are advised to monitor for any attempts to re-register the domain or spin up similar infrastructure under different names. User awareness training should emphasize verifying the legitimacy of theater or event-related websites, particularly those using non-standard domain structures or unexpected branding elements.