slon3to[.]ru

PhishDestroy identifies slon3to.ru as an active phishing domain involved in a generic phishing threat, specifically deploying fake login scams. There is no clear evidence of brand impersonation or use of a specialized drainer kit at this time. The domain appears designed to deceive users into submitting sensitive credentials through counterfeit login interfaces.

Technical indicators show that slon3to.ru has a VirusTotal detection score of 2 out of 95, indicating it has not yet been flagged by antivirus engines. The domain was registered through REGRU-RU on February 22, 2026, and resolves to the IP address 172.67.152.248. It uses a Let's Encrypt SSL certificate, which may lend a false sense of legitimacy. There is no current Google Safe Browsing (GSB) status or blocklist count available, and no detections have been reported on major blocklists at this time.

The domain's status is actively under investigation, with PhishDestroy monitoring for emerging threats or changes in detection rates. Due to its recent creation and lack of antivirus flags, users should exercise caution and avoid submitting personal information on this site. Security teams are advised to track this domain for potential inclusion in blocklists as more data becomes available. Overall, the risk remains uncertain but potentially high given the phishing nature, warranting vigilance and verification through trusted threat intelligence sources.