slon2at3[.]ru

PhishDestroy identifies slon2at3.ru as a credential harvesting phishing domain designed to mimic legitimate login portals and trick users into surrendering sensitive credentials. The domain lacks association with any reputable brand, suggesting a standalone campaign targeting unsuspecting visitors. No evidence of a known drainer kit or cloning of a specific service was found during initial analysis, but the site's behavior aligns with typical phishing lures that harvest usernames and passwords for later exploitation or sale on dark web markets.

This domain was flagged by PhishDestroy with a credential harvesting threat vector. Technical indicators corroborate its suspicious nature: VirusTotal currently reports 4/95 detections (0% detection rate), indicating it has evaded mainstream antivirus engines thus far. The domain resolves to IP address 205.185.113.136 and was registered via REGRU-RU on March 11, 2026 — an unusually recent creation date, which often correlates with short-lived malicious campaigns. It holds a valid Let's Encrypt SSL certificate, which may be used to lend false legitimacy to the site. Google Safe Browsing (GSB) status is currently unflagged, and the domain does not appear on major blocklists as of this assessment, though this may change rapidly once the campaign is widely reported.

Slon2at3.ru remains active and is currently under investigation by PhishDestroy. Users should block access to this domain immediately using local network rules or browser-based controls. Remaining risk is classified as high due to the absence of AV detections, the use of HTTPS (which bypasses some filtering), and the domain's recent creation — traits common in fledgling phishing operations. Organizations are advised to update threat intelligence feeds and issue user warnings. Individual users should avoid visiting the site and report any accidental exposure. The domain's risk level is set to 'under_investigation' and may escalate to 'high' upon further evidence of active credential theft.