worzen[.]com

Analysis of worzen.com indicates it is actively used for a generic phishing campaign as of the report date 12 July 2026. The domain was registered on 21 February 2026 through NameCheap, Inc. and presently resolves to the IPv4 address 192.250.235.25, which belongs to AS204800 WHG Hosting Services Ltd located in Singapore. VirusTotal records show that 13 out of 95 security vendors have flagged the domain, and AlienVault OTX lists it in twelve separate threat‑intelligence pulses. The site is listed on two public blocklists and receives a zero trust score from Gridinsoft, reinforcing its malicious reputation. SSL provisioning is supplied by Let’s Encrypt (R12), and the HTTP response returns a 200 status code, indicating the server is actively serving content. The underlying web stack comprises WordPress, MySQL, PHP, Tailwind CSS, LiteSpeed, Google Analytics and HTTP/3, suggesting a conventional content‑management system rather than a bespoke phishing kit. Nameservers ns1.mysecurecloudhost.com and ns2.mysecurecloudhost.com are authoritative for the domain, and the site is currently blocked by PhishDestroy and PhishingDB. The page title returned by the server is “Home – Worzen”, but no further content analysis is available in the provided intelligence. While the technical footprint confirms active hosting and a confirmed phishing classification, the specific target brand or credential‑harvesting vector has not been disclosed in the current data set. Defenders should prioritize blocking the domain at perimeter filters, enforce DNS sink‑hole rules for the associated IP address, and monitor for any newly observed C2 endpoints that may share the same hosting provider. Continuous re‑evaluation of VirusTotal and OTX feeds is advised, as additional detections may surface. Given the recent registration date and the low trust score, the domain should be treated as high‑risk until remediation actions confirm its removal from the environment.