slon--3at[.]ru

PhishDestroy identifies slon--3at.ru as an active crypto drainer domain designed to trick visitors into unknowingly transferring cryptocurrency to attacker-controlled wallets. This domain mimics legitimate crypto platforms to deceive users during transactions, particularly those involving token swaps or wallet connections. Unsuspecting visitors may authorize malicious smart contracts that drain funds directly from connected wallets without additional confirmation, leading to irreversible financial losses. The site exploits trust in crypto infrastructure by using familiar branding elements or promises of exclusive opportunities.

This domain was flagged by PhishDestroy using multiple threat intelligence sources, including VirusTotal where 2 out of 95 security vendors detected malicious activity. Technical analysis reveals the domain was registered through REGRU-RU on February 28, 2026, and resolves to IP address 205.185.113.136. The domain uses a Let's Encrypt SSL certificate to appear legitimate, a common tactic to bypass browser security warnings. The low detection rate at initial flagging (2/95) suggests either recent activation or evasion techniques to avoid immediate detection.

If you visited slon--3at.ru, immediately disconnect your wallet from any dApps or websites you interacted with on this domain. Revoke any unauthorized token approvals through your wallet’s interface or tools like revoke.cash. Transfer remaining funds to a new wallet with a different seed phrase. Monitor your transaction history for unauthorized transfers and consider reporting the incident to your wallet provider and relevant cryptocurrency authorities. Do not reuse passwords or wallet recovery phrases anywhere else. For future protection, use hardware wallets for large transactions and verify URLs through official project channels before any interaction.