slon-4to[.]ru

This domain, slon-4to.ru, is actively flagged as a phishing threat with elevated risk as of July 29, 2026. Infrastructure analysis reveals the domain was registered on February 22, 2026, through REGRU-RU, a registrar frequently associated with malicious activity. The domain resolves to IP address 188.114.97.3, which is part of Cloudflare’s network, a common hosting choice for threat actors due to its privacy and proxy services. Nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com further confirm Cloudflare’s involvement in the domain’s infrastructure.

Security vendor detections on VirusTotal indicate that 6 out of 91 engines have flagged this domain as malicious, providing concrete evidence of its suspicious nature. Additionally, the domain appears on one security blocklist and is specifically blocked by PhishDestroy, reinforcing its classification as a phishing threat. No further details regarding the specific brand or type of phishing content are available at this time, as the exact page content has not been analyzed. Defenders should treat this domain as an active threat.

Immediate actions include blocking the domain and its associated IP (188.114.97.3) at the network level, updating endpoint protection rules, and monitoring for any internal traffic attempting to connect to it. Given the use of Cloudflare’s infrastructure, defenders should also check for other domains using the same nameservers or IP range, as threat actors often reuse hosting providers for multiple campaigns. If this domain is encountered in logs, investigate the source of the connection for potential compromise or credential harvesting attempts. No SSL or HTTP status details are available, so further analysis may be required to assess the domain’s current operational status.