7-zip[.]us

This domain, 7-zip.us, is actively flagged as a high-risk phishing infrastructure targeting users of the 7-Zip file compression software. Registered on December 18, 2025, through Dominet (HK) Limited, the domain presents itself with the page title '7-Zip官方下载 - 免费高效文件解压软件,' suggesting it mimics official 7-Zip download sources, likely to distribute malicious payloads or harvest credentials. Analysis indicates the domain resolves to IP address 172.67.173.232 and employs Cloudflare for hosting and protection, a common tactic to obscure origin infrastructure and evade takedowns. The site is detected on three security blocklists and appears in three threat intelligence pulses, reinforcing its classification as malicious. Fifteen of ninety-five security vendors on a recent scan flagged the domain, though the exact nature of the threat—whether credential harvesting, malware distribution, or another attack vector—remains unconfirmed due to limited public analysis of the site content. Technologies identified include WordPress, MySQL, PHP, and jQuery, which are frequently exploited in phishing campaigns for their ease of deployment and vulnerability to compromise. Defenders should treat this domain as active and high-risk, particularly in environments where 7-Zip is commonly used. Network-level blocking is recommended, along with monitoring for connections to 172.67.173.232 or related subdomains. Given the domain's recent registration and persistent activity as of July 12, 2026, further investigation into associated infrastructure and payloads is warranted to determine the full scope of the campaign.