slon-2-aat[.]ru

slon-2-aat.ru is identified as a phishing domain impersonating Aat payment services, currently active and posing an elevated risk to users. This domain mimics legitimate financial portals to deceive visitors into disclosing sensitive payment credentials or personal information. The threat remains unresolved and continues to operate without takedown interventions. This domain was flagged by 1 of 95 VirusTotal security vendors, indicating low but present detection coverage. It is registered through REGRU-RU, resolves to IP 188.114.97.3, and was created on March 20, 2026. No known blocklist entries or trust scores are available at this time, suggesting a newly emerged threat with minimal historical scrutiny. The domain remains active and unblocked. Users are advised to avoid interaction and report the domain to their security teams or local CERT. Organizations should block the domain and IP at the network perimeter. Continuous monitoring is recommended due to the evolving nature of phishing campaigns and the potential for rapid escalation in threat sophistication.