theoriq[.]biz

On July 24, 2026, the domain theoriq.biz was identified as a potential phishing domain. The domain resolves to the IP address 172.67.207.21, which is located in the United States and is associated with AS13335, Cloudflare, Inc. At the time of reporting, the domain is offline and returns an HTTP status code 403, indicating that access to the site is forbidden. The domain is registered through NiceNIC International Group Co., Limited and utilizes Cloudflare nameservers (kate.ns.cloudflare.com and syeef.ns.cloudflare.com). The SSL certificate for the domain is issued by Google Trust Services / WE1, suggesting an attempt to appear legitimate and secure.

The domain appears on two security blocklists, PhishDestroy and ScamSniffer, which indicates prior involvement in malicious activities. Analysis indicates that the domain has been flagged by 13 of 95 security vendors, reflecting a notable level of suspicion among the security community. The domain was created on December 11, 2025, which is relatively recent and may suggest a short-term operation or a newly established threat. The hosting infrastructure, including the use of Cloudflare and HTTP/3, suggests an attempt to leverage modern technologies to enhance the credibility and performance of the phishing site.

Defenders are advised to monitor this domain for any signs of reactivation and to ensure that it remains blocked in security systems to prevent potential exposure to phishing campaigns. Additionally, users should be educated to recognize and avoid accessing suspicious domains and to verify the legitimacy of websites before entering any sensitive information. While the exact content and target of the phishing site are not yet analyzed, the elevated risk level and presence on multiple blocklists warrant cautious handling and further investigation.