aizhokvarit-es[.]com

This domain, aizhokvarit-es.com, was registered on June 13, 2026 through Hosting Concepts B.V. d/b/a Registrar.eu and uses Cloudflare nameservers wally.ns.cloudflare.com and weston.ns.cloudflare.com. DNS resolution points to 172.67.217.106, an IP owned by Cloudflare, Inc. in Canada. The site presents a TLS certificate issued by Google Trust Services under the WE1 intermediate, indicating a valid HTTPS endpoint, and enforces HTTP Strict Transport Security. HTTP requests return a 403 status code, suggesting the front‑end is deliberately restricted. The page title observed is “Zhokvarit – Análisis impulsado por IA para los mercados de criptomonedas y acciones”, which aligns with a credential phishing campaign targeting users interested in AI‑driven crypto and stock analysis. The infrastructure incorporates Google Analytics, Cloudflare Browser Insights and HTTP/3, typical of modern phishing kits. VirusTotal scans have flagged the domain in 6 of 91 security engines, and the domain appears on three public blocklists, including PhishDestroy, MetaMask, and SEAL. Gridinsoft reports a trust score of 0 out of 100. The threat is classified as generic_phishing with a high risk rating and remains active. While the exact phishing payload and landing pages have not been publicly disclosed, the combination of a reputable TLS certificate, HSTS, and analytics suggests an attempt to appear legitimate. Defenders should block the domain at DNS and proxy layers, monitor for credential submissions related to the advertised AI analysis services, and consider adding the IP address 172.67.217.106 to deny lists, noting that Cloudflare may host other unrelated services on the same address. Continuous monitoring of the listed blocklists and periodic re‑scanning of the domain are recommended to detect any changes in its behavior.