3-slon3at[.]ru

The domain 3-slon3at.ru was identified as a credential harvesting phishing site targeting users of the Slon3at platform. Analysis confirms the domain was designed to mimic legitimate login portals, likely to capture user credentials through fraudulent input forms. The domain is currently offline, though historical activity indicates it was actively serving phishing content prior to takedown. Infrastructure analysis reveals the domain was registered through REGRU-RU on March 28, 2026, and resolved to the IP address 205.185.113.136. Security vendor detection rates were significant, with 11 of 95 vendors on VirusTotal flagging the domain as malicious. The domain appeared on one security blocklist and received a trust score of 0/100 from independent threat assessment platforms. The page title, encoded in Cyrillic, translated to 'Why some Slon3at islands are forbidden for visiting,' suggesting an attempt to lure users under false pretenses. Current status indicates the domain has been taken offline, though residual risk remains due to potential reuse of the infrastructure or registration of similar domains. Organizations are advised to block the domain and associated IP at the perimeter, monitor for credential leaks tied to this campaign, and alert users who may have interacted with the site. Security teams should review logs for connections to 205.185.113.136 and correlate with known phishing indicators. Proactive measures include implementing multi-factor authentication and conducting user awareness training to mitigate future credential harvesting attempts.