slon-2--------at[.]ru

This domain, slon-2--------at.ru, is currently flagged as a high-risk phishing site targeting Russian-speaking users under the guise of an online store for natural honey and beekeeping products. Analysis indicates the domain was registered on March 28, 2026, and resolves to the IP address 168.100.8.206, hosted in the Netherlands by BL Networks. The site returns an HTTP 200 status, suggesting it is operational, and presents a page titled 'Slon2.at — интернет-магазин натурального мёда и продуктов пчеловодства с доставкой,' which mimics legitimate e-commerce platforms. Infrastructure analysis reveals the domain is associated with Let's Encrypt SSL certificate E8, a common choice for both legitimate and malicious sites due to its free availability. The domain appears in 8 threat intelligence pulses on AlienVault OTX, indicating prior detection by security researchers. Additionally, it is blocked by at least one security vendor and flagged by 3 out of 95 security engines on VirusTotal, further corroborating its malicious classification. The domain is also listed on a security blocklist, and its trust score is rated 0 out of 100 by Gridinsoft. What remains uncertain is the specific phishing kit or threat actor behind this domain, as no definitive attribution data is available. The site may be harvesting payment details, login credentials, or personal information under the pretense of selling beekeeping products. Defenders should treat this domain as actively malicious and implement blocking measures at the network and endpoint levels. Monitoring for connections to 168.100.8.206 or related domains with similar naming patterns is recommended to prevent potential compromise. Given its recent registration and ongoing activity, this domain poses a credible threat to users who may be deceived by its fraudulent storefront.