6slon--cc[.]ru

This domain, 6slon--cc.ru, posed an elevated risk as a generic phishing site, specifically functioning as a crypto drainer designed to steal cryptocurrency credentials and funds. PhishDestroy identified it as part of an active campaign targeting users of construction supply services, but its true intent was to siphon digital assets. The site was taken offline, but its infrastructure remains a concern for potential reactivation.

Technical indicators paint a clear picture of malicious activity. VirusTotal flagged the domain with 1 out of 95 security vendors marking it as malicious, indicating some detection but not widespread. The domain was registered through FE-RU on May 07, 2026, a future date suggesting possible data manipulation or a placeholder. It resolves to IP address 96.9.124.31, and its SSL certificate was issued by Let's Encrypt (E8), a common choice for both legitimate and malicious sites. The page title claimed to be "Slon6 — оптовые поставки строительных смесей в Санкт-Петербурге | slon6.cc," impersonating a building materials supplier. It appeared on one security blocklist, confirming its inclusion in threat intelligence feeds.

To stay safe, users should never visit this domain or click any links associated with it. If a user has already interacted, they should immediately change passwords for any accounts entered, enable two-factor authentication, and monitor cryptocurrency wallets for unauthorized transactions. PhishDestroy recommends reporting the domain to relevant authorities and blocking it at the network level. Always verify URLs carefully, especially those mimicking legitimate businesses, and use hardware wallets for crypto storage to minimize exposure to such drainers.