zenrix[.]world

Analysis of the domain zenrix.world indicates an active credential-phishing infrastructure targeting Ukrainian-speaking users. The domain was registered on February 4, 2026, through Spaceship, Inc., and remains operational as of July 12, 2026. The page title, 'Які продукти покращують зір і корисні для очей | Дім Оптики,' suggests an attempt to impersonate an eye-care or optical retail brand, though no specific legitimate brand name is confirmed in the available data. The site is hosted behind Cloudflare, resolving to the IP address 172.67.169.215, which is geolocated to Canada. Nameservers huxley.ns.cloudflare.com and ligia.ns.cloudflare.com are in use, and the SSL certificate is issued by Google Trust Services (WE1). Infrastructure analysis reveals the deployment of Cloudflare Browser Insights and HTTP/3, which may be leveraged to obscure malicious activity or enhance evasion. The domain is flagged by one security blocklist and is classified as a credential-phishing threat. Five of ninety-one security vendors on VirusTotal have detected the domain as malicious, though the absence of detections from other vendors does not imply safety. The site returns an HTTP 200 status, indicating active content delivery. Defenders should treat this domain as high-risk. Blocking the domain and its resolving IP at network and endpoint levels is recommended. Given the use of Cloudflare, additional monitoring of related infrastructure may be necessary to identify potential pivot points or secondary domains. The exact content and functionality of the phishing page remain unanalyzed, so further investigation into submitted credentials or backend systems is advised if exposure is suspected.