slon---7[.]ru

This domain, slon---7.ru, is actively flagged as a credential phishing site with a high-risk classification. Analysis indicates the domain was registered on March 28, 2026, and currently resolves to IP address 172.67.182.116, hosted under Cloudflare infrastructure in Canada. The page title, 'SLON7.TO - цирковые слоны в новой шоу программе в Лужниках,' suggests a fraudulent ticketing scheme for a purported circus event, though the exact content and target brand remain unverified beyond this title. Security vendors have detected malicious activity, with 7 of 94 engines flagging the domain, and it appears on at least one blocklist. The domain is also referenced in 22 threat intelligence pulses, reinforcing its association with phishing campaigns. Infrastructure analysis reveals the use of Cloudflare services, including Cloudflare Browser Insights, and HTTP/3 protocol support, which may complicate traditional detection and mitigation efforts. The site returns an HTTP 200 status, indicating active hosting, and employs a Let's Encrypt SSL certificate (serial E8) for encrypted connections. Defenders should prioritize blocking this domain at the DNS or network level, particularly in environments where users may seek event tickets or entertainment-related services. While the specific phishing kit or backend infrastructure is not identified, the combination of Cloudflare hosting, recent registration, and security vendor detections warrants immediate containment. Further analysis of the site's content and payload delivery mechanisms is recommended to determine the full scope of the threat.