swedenconsul[.]ru

The domain swedenconsul.ru is currently under investigation for phishing activity targeting users of Ellipsis Finance, a cryptocurrency platform. Registered on February 21, 2026, the domain resolves to IP address 188.114.96.3, hosted on Cloudflare's infrastructure (AS13335). The page title, 'Ellipsis Finance обзор: Изучаем возможности платформы,' explicitly references Ellipsis Finance, suggesting an attempt to impersonate or mislead users about the platform's services. Infrastructure analysis reveals the use of Cloudflare nameservers (journey.ns.cloudflare.com and cris.ns.cloudflare.com) and an SSL certificate issued by Google Trust Services (WE1). The site employs HTTP/3 and is linked to Amazon Web Services, common in both legitimate and malicious deployments. While the domain is actively blocked by PhishDestroy and appears on one security blocklist, it remains accessible with an HTTP 200 status, indicating no server-side restrictions. No detections were reported by the 93 vendors that scanned the domain on VirusTotal, though this absence does not confirm safety. The domain's trust score from Gridinsoft is 0/100, reinforcing its suspicious status. Defenders should treat this domain as high-risk for phishing, particularly for users engaging with cryptocurrency platforms. Monitoring for additional blocklist inclusions and further analysis of its content and network behavior is recommended. Until more evidence is gathered, caution is advised when encountering this domain or any links associated with it.