slon2-------at[.]ru

Analysis of slon2-------at.ru shows a high‑risk generic phishing indicator set. The domain was registered on 28 Mar 2026 and resolves to 64.7.198.41, an IP located in Romania and owned by BL Networks. The web server returns HTTP 200 and presents a TLS certificate issued by Let’s Encrypt (issuer identifier YE2). The page title is displayed as “Slon2.at — интернет‑магазин товаров для ногi и медици…”, a partially garbled Cyrillic string suggesting a Russian‑language storefront theme, but the actual page content has not been examined. Gridinsoft assigns a trust score of 0 / 100, indicating no confidence in the site’s legitimacy. AlienVault OTX references the domain in eight separate threat‑intel pulses, and it is listed on one public security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that 2 of 94 scanned security vendors flagged it as malicious. The domain remains active. While the exact phishing payload or credential‑harvesting mechanisms are not yet confirmed, the combination of a recent registration, low trust score, malicious detections, and inclusion in multiple threat feeds warrants immediate defensive action. Organizations should add the domain and its IP address to outbound filtering rules, monitor DNS queries for related lookups, and consider broader network‑level blocking to prevent potential credential theft or malware delivery.