slon3cc-o[.]ru

PhishDestroy identifies slon3cc-o.ru (seed: a449ac) as an active generic phishing domain designed to harvest login credentials. The domain does not currently impersonate a specific brand, indicating a broad credential-harvesting campaign. Infrastructure points to a crypto-drainer style kit, aligning with recent trends in opportunistic theft. slon3cc-o.ru was registered on March 08, 2026, through REGRU-RU and resolves to IP 205.185.113.136. The domain holds a valid Let’s Encrypt SSL certificate and currently shows zero detections on VirusTotal (4/95). Google Safe Browsing (GSB) has not yet blacklisted the domain, and no third-party blocklists flag it at this time. This domain is categorized as active and remains under investigation. Users are advised to avoid clicking links to slon3cc-o.ru and to verify any suspicious URLs using PhishDestroy. While no detections exist yet, the combination of fresh registration, live infrastructure, and generic phishing tooling presents a latent risk. Immediate containment is recommended until behavioral patterns and payloads are fully analyzed. Remaining risk is evaluated as elevated due to active status and unpatched detection gaps.