sat52[.]ru

This domain, sat52.ru, operates as a credential harvesting phishing infrastructure targeting corporate authentication systems. Analysis of page content reveals a fraudulent representation of Общество с ограниченной ответственностью «САРОВАТОМТЕХ», a Russian business entity, suggesting an attempt to deceive employees or partners into disclosing login credentials, financial details, or internal documentation. The domain's design and branding mimic legitimate corporate portals, increasing the likelihood of successful social engineering attacks against targeted organizations. Infrastructure analysis reveals multiple high-risk indicators. The domain was registered on February 21, 2026, through an undisclosed registrar, with resolution to IP address 84.38.177.18 hosted on AS49505 (JSC Selectel, RU). Security vendor detections on VirusTotal report 18/95 engines flagging the domain as malicious, while it appears on one additional security blocklist. The domain utilizes a Let's Encrypt SSL certificate (R12), providing a false sense of security to potential victims. Despite its current offline status, historical activity and detection patterns indicate a persistent threat to enterprise security. Users who accessed sat52.ru should immediately initiate incident response protocols. All credentials entered on the site must be considered compromised and reset across all systems where identical or similar passwords were used. Organizations should review authentication logs for unusual access patterns and implement multi-factor authentication where not already enforced. Network administrators are advised to block the domain and associated IP (84.38.177.18) at perimeter security controls, while endpoint protection systems should be updated to recognize this threat. Any financial or sensitive data submitted through the portal should be reported to relevant compliance authorities for further investigation.