zoferex[.]com

zoferex.com was registered on February 21, 2026 through Global Domain Group LLC and is hosted on Cloudflare’s network (AS13335). The authoritative nameservers joel.ns.cloudflare.com and nora.ns.cloudflare.com resolve the domain to the IPv6 address 2a06:98c1:3120::3, which is geolocated to the United States. The site presents a Cloudflare interstitial page titled “Suspected phishing site | Cloudflare”, and the HTTP response is a 403 status code, indicating that access has been blocked. The TLS certificate is issued by Google Trust Services under the WE1 root, confirming that the connection is encrypted but does not attest to the legitimacy of the content. Multiple threat‑intelligence sources have flagged the domain.

PhishDestroy lists it as a blocked phishing site, and the Gridinsoft trust score is 1 out of 100, reflecting extreme risk. The domain appears on one security blocklist. VirusTotal has recorded 14 positive detections out of 95 scanning engines, reinforcing the suspicion of malicious activity. The overall risk rating is elevated, and the current operational status is offline. The evidence points to a social‑media phishing campaign, although the specific target platform is not disclosed in the available data.

Because the domain is already inaccessible and Cloudflare has issued a 403 response, immediate mitigation actions are limited to updating defensive controls. Organizations should add zoferex.com to URL filtering, DNS sinkhole, and endpoint blocklists, and monitor for any related domains that share the same registrar, nameserver pattern, or IP range. Continuous observation of Cloudflare‑hosted IPv6 blocks for new phishing indicators is advised. Until further forensic analysis of the site content is possible, the domain should be treated as malicious.