slon3---------------at[.]ru

Analysis indicates that slon3---------------at.ru is currently active and serving HTTP content with a 200 response code. The site was registered on March 28, 2026 and presents a Let's Encrypt certificate (E8), which offers basic TLS encryption but does not imply legitimacy. The page title, rendered as garbled Cyrillic text, suggests an attempt to present a Russian-language internet‑magazine front, a common camouflage technique for credential‑harvesting pages.

Infrastructure analysis reveals that the domain resolves to the IP address 168.100.8.206, which is hosted by a network provider located in the Netherlands. The same IP has been flagged by the PhishDestroy blocklist and appears in a single AlienVault OTX pulse, indicating at least one external intelligence source has identified malicious activity associated with this host. VirusTotal scans show that 2 out of 95 security vendors have flagged the domain, reinforcing the suspicion of malicious use despite the low overall detection rate.

The low Gridinsoft trust score of 0 out of 100 further underscores the lack of trustworthiness, as this metric reflects a historical pattern of abusive behavior. Combined with the domain's recent creation date, the presence on a blocklist, and the minimal but notable vendor detections, the site aligns with typical characteristics of a generic phishing operation aimed at harvesting user credentials under the guise of a legitimate online magazine.

Defenders should block DNS resolution for slon3---------------at.ru and monitor outbound traffic for connections to the associated IP 168.100.8.206. Email security gateways should be configured to flag any messages containing links to this domain, and endpoint protection solutions should prioritize detection of any payloads or scripts delivered from the site. Continuous monitoring of threat intelligence feeds for additional references to the domain or IP will help maintain situational awareness as the campaign evolves.