watchoor[.]zone

This domain, watchoor.zone, is actively flagged as a high-risk phishing site and remains operational as of July 12, 2026. Infrastructure analysis reveals it resolves to 104.21.43.79, an address protected by Cloudflare, which also serves as the domain registrar. The SSL certificate is issued by Google Trust Services, a common configuration for both legitimate and malicious sites leveraging Cloudflare’s infrastructure. The page title, 'Nur einen Moment…', suggests a temporary redirect or interstitial page, though the exact content and target brand remain unconfirmed. Technologies detected include Cloudflare Browser Insights and HTTP/3, consistent with modern web hosting but offering no definitive indicators of malicious intent on their own. The domain appears on 23 threat intelligence pulses in AlienVault OTX and is blocked by at least two security blocklists, including PhishDestroy and BLP-Malware. Five of 95 security vendors on VirusTotal flag the domain as malicious, though the absence of additional context limits the weight of this signal. The Gridinsoft trust score of 0/100 further supports the classification as high-risk. Defenders should treat this domain as actively hostile, particularly given its persistence despite blocklist inclusion. Immediate action is recommended, including network-level blocking of the IP and domain, monitoring for related infrastructure (e.g., subdomains, sibling IPs), and reviewing logs for connections to 104.21.43.79. No specific phishing kit or brand impersonation has been confirmed, so detection rules should focus on the domain itself and its resolved IP rather than assumed content patterns.