slon--4[.]ru

PhishDestroy identifies slon--4.ru as an active crypto-drainer domain designed to steal cryptocurrency from wallet holders. The site masquerades as a legitimate wallet interface but silently drains tokens when users connect their wallets. Once credentials or private keys are entered, funds are transferred without consent, often within seconds, leaving victims with irreversible losses. The domain specifically preys on users searching for wallet services or NFT tools, intercepting traffic through deceptive ads or phishing links. This domain was flagged by PhishDestroy after VirusTotal analysis showed only 1 out of 95 security vendors detected the threat as of seed 2ce8ef. The domain slon--4.ru was registered through RU-CENTER-RU on February 19, 2026, and resolves to IP address 188.114.96.3, which is associated with malicious hosting environments. Despite using a Let's Encrypt SSL certificate to appear legitimate, the domain is less than one month old, a common tactic among scammers to avoid long-term scrutiny. The low detection rate on VirusTotal suggests this threat is still emerging, making it harder for automated tools to catch. If you visited slon--4.ru or entered any wallet credentials or private keys, disconnect your wallet immediately and revoke any unauthorized smart contract approvals using tools like Revoke.cash or Etherscan. Do not interact with any further prompts from the site. Report the domain to PhishDestroy for further analysis and share your experience to help others avoid this scam. Always verify URLs manually and use bookmarked links for official wallet services, never click ads or unknown links for crypto-related logins.