z2[.]o6k[.]biz

Analysis of z2.o6k.biz as of July 25, 2026 indicates an active high-risk phishing domain currently resolving to IP address 154.204.210.122, hosted through CloudFly Net Inc in Hong Kong. The domain is registered via Chengdu West Dimension Digital Technology Co., Ltd., a Chinese registrar, and uses nameservers ns1.myhostadmin.net and ns2.myhostadmin.net. This hosting and registration profile is consistent with infrastructure commonly associated with low-accountability threat actors operating in the Asia-Pacific region.

The domain carries a TrustAsia DV TLS RSA CA 2025 SSL certificate issued by TrustAsia Technologies, Inc. Domain-validated certificates of this type are freely obtainable and provide no meaningful assurance of site legitimacy, serving primarily to add the appearance of security to fraudulent infrastructure.

VirusTotal detection stands at 19 out of 91 security vendors, a significant positive detection rate indicating broad industry recognition of this domain as malicious. The domain is confirmed blocked by PhishDestroy and appears on one security blocklist. The HTTP response returns a 403 Forbidden status with a matching page title of 403 Forbidden, suggesting the active payload or phishing content may be access-restricted, path-specific, or temporarily gated behind conditional logic rather than openly served at the root URL. This does not reduce the assessed risk level, as 403 responses are frequently used to obscure phishing kit activity from automated crawlers.

The exact brand or service being impersonated has not yet been confirmed through available intelligence. Defenders are advised to block 154.204.210.122 and the domain at the network perimeter, treat any inbound links referencing this domain as malicious, and monitor for subdomains or related infrastructure sharing the same nameserver pair or IP address.