slon4-to[.]ru

Analysis of slon4-to.ru, created on February 22 2026 and registered through the REGRU-RU registrar, shows a clear pattern of malicious infrastructure. The domain resolves to the IP address 104.21.94.150 and is served by Cloudflare nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com, confirming that the hosting is outsourced to a CDN provider. The domain is listed on one security blocklist and is explicitly blocked by the PhishDestroy feed, indicating that at least one reputable anti‑phishing service has observed abusive activity originating from this host.

VirusTotal scans have recorded four positive detections out of ninety‑one security vendors, providing additional corroboration that the site is being used for phishing. No further public content, page titles, or brand‑specific lures have been disclosed, so the exact phishing vector remains unknown. However, the combination of recent registration, Cloudflare‑based hosting, blocklist inclusion, and multi‑vendor detections constitutes strong evidence of an active phishing operation.

Defenders should immediately add slon4-to.ru and its resolving IP 104.21.94.150 to network‑level deny lists, monitor DNS queries for the domain, and consider tightening email filtering for messages referencing the domain. Ongoing observation of the Cloudflare edge IP range for related activity is recommended, as threat actors often reuse CDN resources across campaigns.