zentra-ix[.]pro

Analysis of zentra-ix.pro indicates an active generic phishing operation. The domain was registered on March 03, 2026 through Web Commerce Communications Limited and resolves to the IP address 172.67.161.149, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site returns an HTTP 308 status code and presents a page title of "Buy," suggesting a commercial lure. Infrastructure profiling shows the use of Cloudflare’s DNS (sloan.ns.cloudflare.com, bryce.ns.cloudflare.com) and SSL certificate issued by Google Trust Services, confirming a valid TLS endpoint. VirusTotal reports ten of ninety‑four scanners flagging the domain, and Gridinsoft assigns a trust score of zero out of one hundred, reinforcing the high‑risk assessment. The page loads third‑party libraries such as Chart.js, jsDelivr, Facebook Pixel, cdnjs, and employs Cloudflare Browser Insights and HTTP/3, typical of modern phishing kits. The domain is currently listed on one security blocklist and has been blocked by PhishDestroy. Defenders should add the domain and its resolving IP to deny‑list rules, monitor for related Cloudflare‑hosted subdomains, and treat any traffic to the site as malicious. Continuous observation is advised, as the infrastructure could be leveraged for additional campaigns.