slon-cc2[.]ru

Analysis of slon-cc2.ru indicates a high-risk phishing domain targeting users through a fraudulent book digitalization and audio conversion service. The domain, registered on March 28, 2026, currently resolves to IP address 172.67.204.206, hosted behind Cloudflare infrastructure in Canada. The site returns an HTTP 301 redirect, suggesting it may be funneling traffic to another malicious endpoint. Its page title, 'Оцифровка книг Slon2.cc реставрация изданий и перевод в аудиоформат,' explicitly references Slon2.cc, a known platform for digitizing books, which may be leveraged to lend false credibility to the operation. Technical indicators reinforce the domain's malicious classification. The domain is flagged by one threat intelligence pulse on AlienVault OTX and appears on at least one security blocklist. Six of 94 security vendors on VirusTotal have detected the domain as malicious. The SSL certificate, issued by Let's Encrypt (serial number E8), provides encryption but does not validate legitimacy, as phishing sites routinely use free certificates to appear secure. Cloudflare Browser Insights and HTTP/3 are also detected, typical of modern phishing infrastructure designed to evade detection and improve performance. The domain's creation date, four months prior to this report, aligns with common phishing lifecycle patterns, where domains are registered shortly before use to avoid preemptive blacklisting. While the exact nature of the phishing scheme—whether credential harvesting, payment fraud, or malware distribution—remains unconfirmed due to lack of deeper content analysis, the combination of technical red flags and known intelligence sources confirms its active and malicious status. Defenders should treat this domain as hostile, block resolution at the DNS level, and monitor for related infrastructure using the same IP or certificate authority patterns.