slon-03[.]ru

PhishDestroy identifies slon-03.ru as an active crypto drainer impersonation domain currently under investigation rather than a generic phishing page. The domain mimics a spoofed brand identity likely targeting cryptocurrency users through fake wallet or transaction interfaces that silently drain funds. No specific drainer kit fingerprint or JavaScript payload has been extracted from the live site at this time, but behavior patterns suggest clipboard manipulation or wallet signature abuse remains the attacker’s primary tactic.

Domain technical indicators reveal a high-risk configuration: VirusTotal shows 0 detections out of 95 engines as of the latest scan, indicating it remains under the radar despite active hosting. The domain was created on February 21, 2026—just days ago—through RU-CENTER-RU, a registrar known for anonymity-friendly registrations. It resolves to IP 188.114.96.3, a Cloudflare IP often reused in bulletproof hosting environments, and is secured with a Let’s Encrypt TLS certificate to appear legitimate. Google Safe Browsing does not yet flag the domain, and no third-party blocklists have been applied, leaving users completely exposed.

Current status for slon-03.ru is active and unresolved—due to zero detections and no brand takedown, the threat remains live and expanding. The recommended response is to block the IP 188.114.96.3 and domain at the network perimeter and instruct affected users to revoke any wallet signatures or permissions granted while the domain was accessible. Remaining risk is high, as the domain’s youth and registrar choice facilitate rapid iteration and evasion; users should treat all wallet connection prompts from unknown domains with extreme skepticism and prefer hardware wallets for high-value transactions.