slon----6at[.]ru

The domain slon----6at.ru is currently active and returns HTTP status 200. The web server is identified as Nginx and the site uses a valid Let’s Encrypt certificate issued by the E7 intermediate. DNS resolution points to 216.203.20.115, an address allocated to BL Networks in the Netherlands, and the domain is served through Cloudflare name servers (dalary.ns.cloudflare.com and sage.ns.cloudflare.com). Registration occurred on 12 May 2026 via a FE‑RU registrar. The page title contains Cyrillic text referencing “авторские флорары и террадиумы…”, suggesting a Russian‑language phishing lure, though the full page content has not been examined. The domain appears on one security blocklist and is flagged by PhishDestroy as a phishing site. VirusTotal recorded one positive detection out of 92 scanners, and Gridinsoft assigns a trust score of 0 / 100, indicating high malicious confidence. Defenders should block slon----6at.ru at perimeter firewalls and endpoint filters, monitor DNS queries to the associated IP, and consider sink‑holing the address to disrupt credential harvesting. Continuous monitoring is advised to detect any infrastructure changes or content updates.