szvon-ex[.]com

Analysis of www.szvon-ex.com shows a newly registered domain (created 21 Feb 2026) that is hosted behind Cloudflare’s network (AS13335) and terminates TLS with a Google Trust Services / WE1 certificate. The site resolves to 188.114.97.3, a Cloudflare‑owned address located in the United States, and serves content over HTTP/3 with a 200 OK response. The only visible page element is the title “Just a moment…”, which provides no functional insight. Reputation data indicates the domain appears on a single security blocklist and has been flagged by PhishDestroy as a social‑media phishing campaign. AlienVault OTX lists the domain in one pulse, and VirusTotal reports six detections out of ninety‑three scanners, reflecting a low but non‑zero malicious rating. The Gridinsoft trust score of 0 / 100 further confirms a lack of trust. Nameservers are alla.ns.cloudflare.com and huxley.ns.cloudflare.com, consistent with the Cloudflare hosting. No additional infrastructure such as command‑and‑control servers, payload URLs, or email‑sending services has been observed. Because the domain is actively serving content and is already listed by multiple threat‑intelligence sources, defenders should block any outbound or inbound traffic to the host, add the domain to URL filtering policies, and monitor for related lookup activity. Continuous re‑evaluation is advised in case further indicators, such as phishing page snapshots or credential‑harvesting endpoints, become available.