zlon2[.]cc

Analysis of zlon2.cc shows that the domain was registered on 2026-03-03 through Cloudflare, Inc. and uses Cloudflare’s authoritative nameservers collins.ns.cloudflare.com and vern.ns.cloudflare.com. DNS resolution points to IP address 104.21.2.210, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site currently returns HTTP 403 and presents a page title of “Captcha”; no TLS certificate was observed, indicating the service was operating without encryption. The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy feed.

VirusTotal reports that six of ninety‑five scanning engines flagged the domain, reinforcing the suspicion of malicious use. The combination of a recent creation date, Cloudflare‑hosted infrastructure, lack of HTTPS, and the presence of a CAPTCHA‑titled page aligns with typical patterns of generic phishing landing pages that aim to deter automated crawlers while presenting a barrier to casual visitors. Because the domain is presently offline, real‑time content cannot be examined, and the exact phishing lure or credential‑harvesting form remains unknown.

Defenders should continue to enforce blocklist rules that include zlon2.cc, monitor any future DNS re‑resolution to the same IP or Cloudflare name‑servers, and consider adding the IP address 104.21.2.210 to network‑level deny lists until the hosting provider confirms remediation. Threat‑intel platforms should note the six VirusTotal detections as an indicator of compromise and correlate them with any observed outbound connections to the same address. Organizations using web‑filtering solutions are advised to keep the domain listed in URL‑filter policies and to alert users that any request to a “Captcha” page on this host is likely part of a phishing campaign.