slon6to[.]ru

On July 29, 2026 the domain slon6to.ru was identified as an active generic phishing infrastructure with an elevated risk rating. The domain was registered through the REGRU-RU registrar on 22 February 2026 and is currently hosted on the IP address 188.114.97.3, which is resolved via Cloudflare's DNS service (authoritative nameservers dante.ns.cloudflare.com and mckinley.ns.cloudflare.com). The domain appears on one security blocklist and has been blocked by the PhishDestroy mitigation service.

VirusTotal analysis shows that six of ninety‑one scanning engines have flagged the domain as malicious, indicating a modest but non‑trivial detection consensus among anti‑malware vendors. No additional public intelligence such as Open Threat Exchange entries, Safe Browsing verdicts, or SSL certificate details were provided in the source data. The limited visibility suggests that the infrastructure is relatively new, having been created less than five months before the report date, and may be employing standard phishing kits without a distinctive payload fingerprint.

Defenders should add the domain to inbound and outbound filtering rules, monitor network traffic for connections to 188.114.97.3, and consider expanding the blocklist coverage to include the observed Cloudflare nameservers. Ongoing reconnaissance should focus on capturing HTTP response headers, page titles, and any further VirusTotal submissions to refine the threat profile and assess whether the domain is being leveraged for targeted credential harvesting campaigns.