slon2-slon2-at[.]ru

This domain, slon2-slon2-at.ru, is identified as a generic phishing site designed to impersonate a legitimate custom keycap retailer. The page title, 'Slon2 at — Custom Keycaps на заказ, клавиши PBT и artisan-наборы,' suggests it targets users seeking specialized keyboard components, likely to harvest payment details or personal information under false pretenses. The site does not exhibit overt signs of credential theft or crypto-draining scripts but operates under the guise of a niche e-commerce platform, increasing the risk of financial fraud for unsuspecting visitors. Analysis of the domain reveals multiple technical indicators supporting its malicious classification. The domain was registered on May 29, 2026, via REGRU-RU, a registrar frequently associated with suspicious domains. VirusTotal reports a detection rate of 1/95 security vendors, indicating limited but present recognition as a threat. The domain appears on one security blocklist and resolves to the IP address 188.114.97.3, which is linked to Cloudflare infrastructure. Detected technologies include Tailwind CSS, Yandex.Metrika, and Cloudflare Browser Insights, suggesting an attempt to mimic legitimate e-commerce tracking and design practices while obscuring malicious intent. Users who visited slon2-slon2-at.ru should take immediate action to mitigate potential risks. If any personal or financial information was entered, affected individuals should monitor accounts for unauthorized transactions and consider placing fraud alerts with financial institutions. Clearing browser cache and cookies is recommended to remove any residual tracking elements. Additionally, users should verify the legitimacy of any communications or order confirmations received from the domain, as phishing sites often follow up with further social engineering attempts. Given the domain's current offline status, continued vigilance is advised, particularly for any unexpected follow-up emails or messages referencing custom keycap purchases.