slon3[.]cc-at[.]ru

The domain slon3.cc-at.ru was registered on April 18, 2026 through a Russian registrar (FE-RU) and is currently resolved to the IP address 216.203.20.115, which is allocated to BL Networks in the Netherlands (AS399629). The site presents a page title indicating a Moscow lighting store, but the underlying activity is classified as credential phishing. Infrastructure analysis shows the service is fronted by Cloudflare DNS (dalary.ns.cloudflare.com, sage.ns.cloudflare.com) and served by Nginx with Yandex.Metrika analytics enabled. The site uses a Let’s Encrypt certificate (identifier E8) and returns HTTP status 521, suggesting the origin server is refusing connections. The domain is listed on one security blocklist and has been flagged by PhishDestroy. VirusTotal scans report five detections out of ninety-one vendors, reinforcing the malicious assessment. Gridinsoft assigns a trust score of 0/100, indicating no confidence in the host. The current risk rating is high and the domain remains active. Defenders should add slon3.cc-at.ru and its resolving IP 216.203.20.115 to deny‑list configurations, monitor for related DNS queries, and consider sinkholing the domain to disrupt credential harvesting attempts. Ongoing surveillance is advised to detect any changes in hosting or certificate attributes, and to update detection signatures accordingly.