zenkoprotocol[.]sbs

The domain zenkoprotocol.sbs is currently listed as an active generic phishing site. DNS resolution points to Cloudflare edge address 104.21.49.3, which is geolocated to Canada and uses the nameservers osmar.ns.cloudflare.com and tricia.ns.cloudflare.com. The site presents a minimal HTTP response with status code 403 and a page title of “Just a moment…”, wrapped in a TLS certificate issued by Google Trust Services under the WE1 intermediate. Registration information shows the registrar as NameSilo, LLC. The domain is flagged by three independent blocklists and has been added to the blocklists of PhishDestroy, MetaMask, and SEAL. VirusTotal analysis reports that six of ninety‑one scanners have generated detections for the domain, indicating a non‑trivial malicious signal. Although the exact phishing payload or targeted brand is not disclosed, the combination of a forced 403 response, Cloudflare hosting, and the observed blocklist presence suggests that the site is being used to lure users to submit credentials or other sensitive data. Defenders should update perimeter controls to deny or redirect traffic to this host, include the domain and its resolving IP in DNS and web proxy blacklists, and monitor for related C2 patterns. Ongoing investigation should focus on capturing HTTP request payloads, correlating any observed credential submissions, and verifying whether the site serves additional malicious content beyond the initial page.