slon------2----a-t[.]ru

This domain, slon2.at, is identified as a high-risk phishing infrastructure. The domain was created on May 18, 2026, and is currently active, posing a significant threat to users and organizations. The page title 'slon2.at — электропрялки и кардеры для прядения, Москва' suggests a front for legitimate business operations, but deeper analysis reveals its malicious nature. The domain resolves to the IP address 45.90.218.59, which is located in Russia and is associated with Firstbyte Hosting. This hosting service has been linked to various other malicious activities in the past, raising additional red flags for defenders. The domain has been flagged by 4 out of 95 security vendors on VirusTotal and appears on one security blocklist, further indicating its involvement in phishing operations. The SSL certificate is issued by Let's Encrypt, which is often used by threat actors to gain user trust. Defenders are advised to block this domain and educate users about the risks of interacting with it. Given the domain's recent creation and its presence on threat intelligence lists, it is crucial to monitor for any related phishing kits or infrastructure that may be used in conjunction with this domain. Regular updates to security policies and user awareness training can help mitigate the risks associated with this phishing domain.