niilm-proposal[.]online

This domain is flagged as a high-risk credential theft operation impersonating the legitimate organization NII LM (АО «НИИ ЛМ»). Analysis indicates the site is designed to harvest corporate login credentials through a fraudulent commercial proposal page, a common tactic in targeted phishing campaigns against enterprise users. Infrastructure analysis reveals multiple concerning indicators. The domain niilm-proposal.online was registered on May 24, 2026, through REG.RU LLC, with an anomalous future creation date suggesting potential domain spoofing. It currently resolves to IP address 37.140.192.194 and is blocked by three security blocklists, including enterprise-grade detection systems. VirusTotal detection shows 1 of 95 security vendors flagging the domain, while the SSL certificate is issued by Let's Encrypt (R13), a common pattern in short-lived phishing infrastructure. The page title explicitly references the impersonated brand, further confirming the targeted nature of this threat. Mitigation requires immediate action from network security teams. Organizations should block the domain and IP at perimeter defenses, particularly for users in procurement or finance departments most likely to receive commercial proposal lures. Security awareness training should emphasize verification of sender domains for all unsolicited business offers, especially those referencing Russian-language organizations. Given the credential theft focus, multi-factor authentication should be enforced for all corporate accounts, and password reset procedures initiated for any users who may have interacted with this domain. The anomalous 2026 registration date should be used as a detection rule for similar threats in domain monitoring systems.