slon----2to[.]ru

The domain slon----2to.ru is a confirmed phishing site engaged in brand impersonation targeting Telegram users. It presents itself as a legitimate Telegram-related service to deceive victims into disclosing login credentials or other sensitive information. No crypto drainer kit was detected on this domain. As of the latest verification, slon----2to.ru has been taken offline.

Technical analysis shows that slon----2to.ru was flagged by 2 of 95 VirusTotal security vendors, including Gridinsoft and SOCRadar, with a Gridinsoft trust score of 0 out of 100. The domain is registered through REGRU-RU and was created on March 14, 2026. It resolves to the IP address 205.185.113.136, hosted by FranTech Solutions in the US (AS53667). The SSL certificate is issued by Let's Encrypt (R13), and the observed page title is 'Slon2.to платформа управления жизненным циклом строительных объектов to'. The domain appears on one security blocklist, PhishDestroy, and uses Nginx as its web server technology. Nameservers for the domain are ns1.reg.ru and ns2.reg.ru.

Victims of slon----2to.ru should immediately change any passwords or credentials entered on the site, particularly for Telegram accounts. Enable two-factor authentication (2FA) on all affected services to prevent unauthorized access. Monitor accounts for suspicious activity and report any fraudulent transactions or unauthorized logins. To help prevent future threats, report the domain to Google Safe Browsing, PhishTank, or other anti-phishing initiatives. If financial or crypto assets were involved, revoke any token approvals and consider moving funds to a new, secure wallet.