slon-10-to[.]ru

The domain slon-10-to.ru has been identified as involved in a credential harvesting phishing campaign. This activity targets unsuspecting users by attempting to collect sensitive login credentials, although no specific brand impersonation or drainer kit has been confirmed at this time. The campaign is currently under investigation to determine the full scope and potential impact of the threat.

Technical analysis reveals that slon-10-to.ru resolves to the IP address 95.163.244.138 and was registered through the REGRU-RU registrar on February 22, 2026. VirusTotal reports a detection ratio of 3 out of 95, indicating it has not yet been flagged by antivirus engines. The domain uses a Let's Encrypt SSL certificate, which may lend it a false sense of legitimacy. There is no current Google Safe Browsing blacklist listing or additional blocklist counts reported.

At present, slon-10-to.ru remains active and classified as under investigation with a risk level not fully determined. Security teams are advised to monitor this domain closely and exercise caution when encountering communications or links associated with it. Users should avoid entering credentials or sensitive information on this domain and report any suspicious activity to their security providers. Continued vigilance and timely updates are essential to mitigate potential harm from this emerging credential harvesting threat.