slon3cc-3[.]ru

PhishDestroy identifies slon3cc-3.ru as an active credential harvesting phishing site targeting unsuspecting users. The domain is currently under investigation but remains operational, posing an immediate threat to anyone who accesses it. This site mimics legitimate login portals to steal credentials, banking details, or personal data under false pretenses. This domain was flagged by 4 of 95 VirusTotal vendors despite hosting malicious content. It was registered through REGRU-RU on March 13, 2026, resolving to IP address 205.185.113.136. The site utilizes a Let's Encrypt SSL certificate, which may falsely imply legitimacy to users. At the time of analysis, the domain is not listed on major blocklists, and trust scores remain critically low due to its recent creation and lack of established reputation. The current status of slon3cc-3.ru is active and dangerous. Users are strongly advised to avoid this domain entirely, report it to their security teams or browser vendors, and warn others. Organizations should update firewall rules and DNS blocklists to prevent access. If credentials were accidentally entered, users must change passwords immediately and monitor accounts for unauthorized activity. Security teams should investigate any logs for connections to this IP or domain, as it may indicate compromised systems within their network.