slon2--at---at[.]ru

Analysis of slon2--at---at.ru indicates an active high‑risk generic phishing site. The domain was registered on 28 March 2026 and is presently serving HTTP content with a 200 response. The page title returned is “Slon2.at — интернет‑магазин комнатных растений и кашпо с доставкой”, confirming a Russian‑language storefront theme. TLS is provided by a Let’s Encrypt certificate (E8), which does not mitigate the malicious intent. DNS resolution points to IP 168.100.8.206, hosted in the Netherlands and associated with BL Networks. The IP address appears on a single security blocklist and has been flagged by PhishDestroy. Reputation scoring from Gridinsoft is 0/100, indicating no trust. VirusTotal analysis shows 2 detections out of 94 scanned security vendors, confirming malicious classification. The domain is also referenced in one AlienVault OTX pulse. No additional intelligence on payload, credential‑harvesting forms, or compromised infrastructure is available. Defenders should block the domain and its resolving IP at perimeter and DNS layers, monitor for related traffic, and consider adding the address to internal blocklists. Ongoing observation is recommended to detect any changes in hosting or additional detections.