slon-9-cc[.]ru

This domain is flagged as a credential harvesting platform specifically targeting users of cryptocurrency wallets and exchange services. Analysis indicates the infrastructure is designed to mimic legitimate wallet login portals, capturing sensitive authentication details such as private keys, seed phrases, and two-factor authentication codes. The domain employs social engineering tactics, including fake security alerts and urgent account verification prompts, to deceive victims into disclosing credentials. Given the irreversible nature of cryptocurrency transactions, compromised credentials can lead to immediate and total asset loss, making this threat particularly severe for digital asset holders. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain slon-9-cc.ru was registered on March 28, 2026, through a registrar known for hosting high-risk domains, and currently resolves to the IP address 95.163.244.138. Security vendors have flagged this domain in 3 out of 95 VirusTotal scans, with detections specifically labeling it as a phishing endpoint. Additionally, the domain appears on one security blocklist and has been proactively blocked by enterprise-grade threat intelligence platforms. The creation date discrepancy—registered in 2026 despite current analysis occurring earlier—suggests either a typo-squatting attempt or an effort to evade temporal reputation-based detection systems. Users who visited slon-9-cc.ru or interacted with its content should assume credential compromise and take immediate remediation steps. First, revoke all active sessions and reset passwords for any cryptocurrency wallets or exchange accounts accessed from the same device or network. Enable hardware-based two-factor authentication where available, and monitor all linked accounts for unauthorized transactions. If private keys or seed phrases were entered, transfer remaining assets to a new, secure wallet immediately, as the original keys are permanently compromised. Report the incident to relevant financial and cybersecurity authorities, and scan all devices used to access the domain for malware, as credential harvesters often deploy secondary payloads to maintain persistence.