slon2--------at[.]ru

Analysis indicates that the domain slon2--------at.ru is actively serving a phishing page targeting Russian-speaking users. The site presents itself as an online store specializing in handmade candles and home aromas, as evidenced by its page title: 'Slon2.at — интернет-магазин свечей ручной работы и ароматов для дома с доставкой.' The domain was registered on March 28, 2026, and currently resolves to the IP address 64.7.198.41, hosted in Romania under the provider BL Networks. Infrastructure analysis reveals that the domain is flagged by multiple threat intelligence sources. It appears in eight AlienVault OTX pulses, suggesting recurring malicious activity. A Gridinsoft trust score of 0/100 further corroborates its high-risk classification. The domain is listed on at least one security blocklist and is actively blocked by PhishDestroy. Two out of 94 security vendors on VirusTotal have detected the domain as malicious, though the specific nature of the threat—whether credential harvesting, payment fraud, or another scheme—remains unconfirmed due to the absence of deeper page analysis. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites, and does not provide conclusive evidence of intent. The site returns an HTTP 200 status, indicating it is operational and accessible. Defenders should treat this domain as an active phishing threat, particularly for users searching for home goods or e-commerce platforms in Russian. Blocking the domain and its resolving IP at the network level is recommended until further analysis confirms the exact payload or fraud mechanism. No brand impersonation or specific scam category beyond the stated product focus has been verified at this time.