slon3cc-l[.]ru

PhishDestroy identifies the domain slon3cc-l.ru as a generic phishing host currently under investigation for active malicious activities. The domain is not yet flagged by security vendors but poses a credible threat, warranting immediate scrutiny by SOC teams and users alike. No specific brand impersonation has been confirmed at this stage, and the threat classification remains under evaluation pending further evidence of targeted lures or infrastructure overlap.

This domain was flagged by 4 of 95 VirusTotal vendors as of the latest analysis, indicating a low detection rate despite its malicious potential. The domain was registered through REGRU-RU on March 08, 2026, and resolves to the IP address 205.185.113.136, which hosts a Let’s Encrypt SSL certificate. Its recent creation date and clean reputation across current threat intelligence feeds suggest it may be a newly deployed resource, possibly leveraging short-lived infrastructure to evade detection. No entries were found on any major blocklists at the time of assessment, and its trust scores across platforms like VirusTotal, URLVoid, and DomainTools remain neutral or undeveloped.

Given its active status and low detection coverage, slon3cc-l.ru represents an emerging threat that could escalate rapidly. Users are advised to block the domain at the network perimeter and DNS level using indicators such as the domain name, associated IP (205.185.113.136), and SSL certificate fingerprint if available. SOC teams should monitor this domain for shifts in detection coverage, DNS changes, or new associations with known malicious IPs or ASNs. Implement strict email filtering rules to quarantine messages containing slon3cc-l.ru or its subdomains, and conduct enhanced user awareness training to mitigate the risk of credential harvesting campaigns. This advisory will be updated as additional intelligence becomes available.