uscr[.]zone

The domain uscr.zone is currently classified as a generic_phishing threat and remains active as of the report date, July 12, 2026. It has been intercepted by at least one security blocklist and is flagged by an external phishing mitigation service. The site returns an HTTP 403 response and presents a page title of "Just a moment...", indicating that access is being deliberately restricted, a pattern observed in other phishing infrastructures.

Infrastructure analysis reveals that the domain was registered through a widely used CDN provider and resolves to the IP address 104.21.44.125, which belongs to the AS13335 network operating in the United States. The authoritative nameservers are mei​lani.ns.cloudflare.com and zahir.ns.cloudflare.com, confirming the use of the same CDN for DNS resolution. The server presents an SSL certificate issued by a major public certificate authority under the designation WE1, and it negotiates HTTP/3, further confirming modern CDN hosting. A security scoring engine assigned a trust score of zero out of one hundred, reflecting a high confidence that the site is malicious.

While the domain has not yet triggered any detections on a leading multi‑engine scanning service, the absence of detections does not imply safety, especially given the zero trust score and active blocklist entry. The exact content of the site beyond the generic title has not been publicly disclosed, leaving the specific phishing payload or credential‑harvesting mechanisms uncertain. Defenders should prioritize adding uscr.zone to outbound filtering rules, enforce DNS sinkholing for the associated IP range, and monitor for any lookup activity from internal hosts. Continuous re‑evaluation is advised, as the threat actor may alter the hosting configuration or deploy additional payloads in the future.