slon-avto[.]ru

The domain slon-avto.ru was registered on March 28, 2026 and currently returns HTTP 200 with the page title "Российский производитель автокомпонентов". The site is served over HTTPS using a Let’s Encrypt R12 certificate, which is valid and automatically renewed, suggesting a legitimate‑looking front end. The content mismatch between the automotive component theme and the observed phishing behavior forms the basis for the generic_phishing classification.

Infrastructure analysis shows the domain resolves to IP address 193.107.236.86, hosted within the NetAngels.RU network in Yekaterinburg, Russia, and appears to be a Rostelecom data centre. The host carries a Gridinsoft trust score of 0 out of 100, indicating a highly untrusted reputation. The same IP is listed on a single security blocklist and has been flagged by PhishDestroy, confirming that external defenders have already taken mitigation steps.

Threat intelligence indicates the domain appears in one AlienVault OTX pulse, but no detections are recorded on VirusTotal (0 of 95 scanners). This lack of detections does not imply safety; rather, it reflects the early stage of the campaign. The absence of malware signatures, combined with the clean VirusTotal profile, leaves the exact payload or credential‑harvesting mechanisms uncertain. The primary indicator of malicious intent is the domain’s appearance on a phishing‑specific blocklist and the mismatched branding presented to potential victims.

Defenders are advised to block slon-avto.ru at the DNS and firewall levels, monitor outbound connections to the associated IP, and incorporate the IP address into intrusion‑detection signatures. Continuous observation of traffic to this host is recommended to capture any evolving payloads. Organizations should also educate users about unexpected automotive‑industry communications, as the domain’s legitimate‑sounding title may be leveraged to increase trust among targeted recipients.