perun-pro[.]ru

Analysis of perun-pro.ru shows a domain created on February 27 2026 that was subsequently taken offline but left a measurable footprint. The domain resolves to the IPv6 address 2606:4700:3037::ac43:ae3e, which belongs to AS13335 Cloudflare, Inc., placing the host in the United States and indicating that the attacker leveraged Cloudflare’s edge network to mask the true origin. The TLS certificate presented is issued by GTS CA 1P5, a Google Trust Services root commonly used by Cloudflare, confirming that the connection was protected by a legitimate‑looking certificate despite the malicious intent. When the site was reachable, the HTTP response code was 200, demonstrating that a web server was actively serving content.

The only publicly observable page element is the title "Как купить закладки круглые в воронеж," a Russian phrase about purchasing round bookmarks in Voronezh, which bears no obvious relationship to a legitimate service and is consistent with a low‑effort phishing lure. VirusTotal recorded a single positive detection out of 93 scanning engines, indicating that at least one security vendor identified the domain as malicious. Independent blocklist providers have also flagged the domain: PhishDestroy has listed it as blocked, and it appears on one additional security blocklist, reinforcing the classification as a phishing resource. The combination of a fresh registration, use of a reputable CDN to hide infrastructure, a valid TLS certificate, and a non‑standard page title suggests a deliberate attempt to gain credibility while directing victims to a malicious payload or credential‑harvesting page.

Defenders should add perun-pro.ru to DNS and URL filtering policies, monitor the associated Cloudflare IP range for related activity, and consider extending blocklists to include the IPv6 address.