slonn3to[.]ru

Analysis of slonn3to.ru indicates it operated as a fraudulent online storefront targeting Russian-speaking consumers under the guise of a Moscow-based outdoor gear retailer. The domain was registered on March 7, 2026, through REGRU-RU, a registrar frequently associated with phishing infrastructure. Infrastructure analysis reveals the site was hosted on IP 81.91.178.10, geolocated in the Netherlands under AS204601 (NovoServe B.V.), with nameservers ns1.reg.ru and ns2.reg.ru. No SSL certificate was present, increasing the risk of credential interception.

The page title, 'slon3.to — интернет-магазин туристического снаряжения в Москве,' explicitly positioned the site as an e-commerce platform for camping equipment, though no legitimate brand affiliation or product inventory was verified. Security vendors flagged the domain on July 25, 2026, with 2 of 94 engines on VirusTotal detecting malicious activity, while PhishDestroy and one additional blocklist had already classified it as abusive. The site was taken offline by the report date, though its prior use of DDoS-Guard (a service often leveraged to obscure hosting origins) suggests an intent to evade takedowns. Gridinsoft assigned a trust score of 0/100, reflecting high-risk characteristics.

Defenders should treat this domain as part of a broader phishing campaign targeting payment or personal data under the pretense of retail transactions. While the exact content and payment mechanisms remain unanalyzed, the combination of a fabricated storefront, lack of encryption, and hosting on bulletproof infrastructure aligns with credential-harvesting or fraudulent order schemes. Network defenders are advised to block the domain and IP, monitor for related registrations under REGRU-RU, and alert users who may have interacted with the site prior to its takedown.