mg-market6at[.]vip

This domain, mg-market6at.vip, is identified as a credential harvesting phishing site targeting users through deceptive logistics-themed content. The site impersonates legitimate supply chain services under the guise of 'Slon4,' a purported logistics provider for construction projects in Russia. Visitors may encounter fraudulent login portals, payment forms, or document requests designed to capture sensitive credentials, financial details, or personal information. The use of a logistics pretext increases the likelihood of targeting professionals in procurement, construction, or corporate finance sectors. Analysis indicates the domain was registered on April 21, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with high-risk domains. The site resolves to the IP address 64.7.198.31 and employs technologies such as C, Perl, Angie, and HTTP/3, which are not inherently malicious but are commonly observed in phishing infrastructure. Detection data from VirusTotal shows 5 out of 95 security vendors flagging the domain as malicious, while it appears on one public blocklist. The page title, written in Russian, suggests a localized or region-specific targeting strategy. If you visited mg-market6at.vip or interacted with its content, immediate action is recommended. Disconnect the affected device from the network to prevent potential data exfiltration. Reset credentials for any accounts accessed during or after the visit, prioritizing email, financial, and corporate systems. Scan the device using updated security tools to detect and remove any malware or persistent threats. Monitor accounts for unauthorized activity and report the incident to relevant IT or security teams. Users should verify the legitimacy of any unexpected logistics or supply chain communications before engaging further.