slon10to[.]ru

PhishDestroy identifies slon10to.ru as an active government-impersonation domain weaponized for credential theft, leveraging a Let’s Encrypt SSL certificate and a deceptive name to appear legitimate. This domain was registered through REGRU-RU on February 22, 2026, and currently resolves to IP 172.67.137.41. VirusTotal analysis shows zero detections out of 95 engines as of seed 79d3f8, and no blocklist entries have been recorded to date. The combination of a freshly minted domain, low detection coverage, and HTTPS encryption creates a plausible lure that can bypass traditional filters. Users who accessed slon10to.ru should immediately cease any interaction, close the browser tab, and scan connected devices for malware. Notify your IT or security team with the domain name and observed behavior. Avoid entering any personal or login information and consider reporting the site to your national cybercrime unit or hosting provider.