slon3at-4at[.]ru

This domain, slon3at-4at.ru, operates as a credential harvesting phishing site targeting users through fraudulent automated control system interfaces. The page title, "Метод автоматизированного контроля Slon3at качества процессов AT и https," suggests an attempt to mimic legitimate process monitoring tools, likely to deceive employees or system administrators into entering sensitive credentials. The domain specifically impersonates quality control systems labeled "Slon3at" and "AT," which may correspond to industrial or enterprise software, increasing the risk of corporate account compromise or unauthorized access to internal networks. Analysis indicates the domain was registered on March 28, 2026, through REGRU-RU, a registrar commonly associated with malicious infrastructure. It resolves to the IP address 205.185.113.136 and is currently listed on one security blocklist. VirusTotal reports 5 out of 95 security vendors flagging the domain as malicious, while Gridinsoft assigns it a trust score of 0 out of 100. The detected technology stack includes Nginx, a web server frequently used in phishing campaigns for its reverse proxy and load balancing capabilities. The domain has since been taken offline, but its infrastructure remains a potential threat if reactivated. Users who visited slon3at-4at.ru or entered credentials on the site should immediately revoke and reset any exposed passwords, particularly for corporate or industrial control system accounts. Enable multi-factor authentication (MFA) on all critical systems to mitigate unauthorized access. Organizations should monitor network traffic for connections to 205.185.113.136 and block the domain at the DNS or firewall level. If system logs indicate interaction with this domain, conduct a full security audit to assess potential data exfiltration or lateral movement within the network. Report the incident to relevant cybersecurity teams for further investigation and containment.