slon-6-to[.]ru

The domain slon-6-to.ru was registered on 22 February 2026 through the REGRU-RU registrar. DNS resolution points to the address 104.21.73.84, which is hosted behind Cloudflare infrastructure as indicated by the authoritative name servers dante.ns.cloudflare.com (listed twice) and mckinley.ns.cloudflare.com. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy filtering service.

VirusTotal analysis shows that six of ninety‑one scanned engines have flagged the domain as malicious, confirming a consensus of concern among antivirus and URL‑reputation products. No additional public blocklists, Safe Browsing entries, or Open Threat Exchange (OTX) reports are currently associated with the domain, and no SSL certificate details, HTTP response codes, or page‑title metadata have been disclosed publicly. The limited visibility suggests that the site may be operating a credential‑harvesting campaign, consistent with its classification as a generic phishing threat.

Defenders should add slon-6-to.ru to local deny lists, enforce DNS‑level blocking, and monitor outbound connections to the hosting IP 104.21.73.84. Continuous re‑scanning with VirusTotal and periodic queries of emerging blocklists are recommended to detect any changes in the detection rate. Organizations employing web‑proxy or gateway filtering should ensure that the domain is explicitly denied, and incident response teams should treat any traffic to this host as potentially malicious.