slon-3-att[.]ru

This domain, slon-3-att.ru, is identified as a credential harvesting phishing site designed to mimic legitimate diagnostic equipment vendors. The page title, 'Slon3.at | Диагностические приборы для проверки оборудования,' suggests targeting of Russian-speaking professionals in technical or industrial sectors, likely attempting to collect login credentials or financial information under the guise of equipment diagnostics services. The infrastructure analysis reveals a deliberate attempt to impersonate trusted suppliers, increasing the likelihood of successful social engineering attacks against unsuspecting users. Evidence supporting this assessment includes detection by 2 out of 95 security vendors on VirusTotal, indicating initial but growing recognition of its malicious nature. The domain was registered on March 28, 2026, through REGRU-RU, a registrar frequently associated with suspicious or high-risk domains. It appears on one security blocklist and resolves to the IP address 104.21.2.123, which is protected by Cloudflare, a common tactic to obscure the true origin of phishing infrastructure. The use of HTTP/3 and Cloudflare Browser Insights further suggests an attempt to evade detection and enhance the site's perceived legitimacy. Users who visited slon-3-att.ru should immediately revoke any credentials entered on the site, particularly those related to financial accounts, corporate networks, or diagnostic equipment platforms. Monitor all associated accounts for unauthorized activity and consider implementing multi-factor authentication where available. Organizations should update their security blocklists to include this domain and its resolved IP address. If the domain was accessed via corporate devices, initiate an incident response protocol to assess potential data exposure or lateral movement risks within the network. Given the elevated risk level, affected users should report the incident to relevant cybersecurity authorities or industry-specific information sharing centers.