slon3at-2at[.]ru

PhishDestroy identifies slon3at-2at.ru as a malicious domain engaged in cryptocurrency wallet drainer operations, a specialized form of phishing designed to illicitly transfer funds from victims' crypto wallets. The domain leverages deceptive tactics to impersonate legitimate services, tricking users into connecting their wallets and authorizing fraudulent transactions. No specific brand impersonation or drainer kit variant is currently documented in open sources, but the domain's infrastructure suggests a focus on crypto-related fraud. The threat actor behind this domain remains under active investigation to determine additional campaign details, such as targeted platforms or wallet types. This domain was flagged with a 5/95 VirusTotal detection score as of the latest scan, indicating it has not yet been widely recognized by antivirus engines. It was registered through REGRU-RU on March 09, 2026, and resolves to IP address 205.185.113.136. The domain utilizes a Let's Encrypt SSL certificate to appear legitimate, and its recent creation date suggests a potentially short-lived or opportunistic campaign. At the time of analysis, this domain has not been flagged by Google Safe Browsing (GSB) and remains unlisted on major threat intelligence blocklists. These factors contribute to a high-risk profile for unsuspecting users, particularly those engaging in cryptocurrency transactions. As of this report, slon3at-2at.ru is classified as an active threat with an 'under_investigation' status, meaning its full operational scope and infrastructure remain under scrutiny. Users are strongly advised to avoid interacting with this domain or any associated links, as the primary risk involves unauthorized cryptocurrency transfers from connected wallets. Immediate actions include blocking the domain at the network level and reporting it to relevant cybersecurity platforms or financial institutions. While the immediate risk to users is high due to its active status and low detection rate, ongoing monitoring will refine the threat assessment. Users should remain vigilant for similar domains and verify website authenticity through trusted sources before engaging in financial transactions.