zf14f[.]com

This domain, zf14f.com, is identified as a high-risk generic phishing infrastructure designed to impersonate retail or marketplace platforms. The page title, Savdo markazi, translates to Trade Center in Uzbek, suggesting a focus on users in Central Asian markets or diaspora communities. No direct association with known drainer kits or specific brands has been confirmed, though the site structure aligns with credential-harvesting phishing pages targeting e-commerce or financial transactions. The absence of overt brand spoofing indicates a broader, opportunistic phishing campaign rather than a targeted impersonation of a single entity. Infrastructure analysis reveals multiple technical indicators of malicious activity. The domain is registered through Gname.com Pte. Ltd. and was created on May 16, 2026, an anomalous future date likely resulting from registrar data entry error or intentional obfuscation. It resolves to the IP address 104.21.30.87, hosted by a content delivery network in Canada, which is frequently leveraged to mask origin infrastructure. VirusTotal reports 10 out of 95 security vendors flagging the domain as malicious, while a single blocklist, PhishDestroy, currently lists it. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites due to its free and automated issuance process. No Google Safe Browsing (GSB) detections are recorded at this time, though this may reflect a lag in propagation rather than benign status. The domain remains active as of the latest verification, with no takedown or sinkholing observed. Users encountering this domain are advised to avoid interaction, particularly inputting credentials or financial details. Network-level blocking of the IP address 104.21.30.87 and domain-level filtering of zf14f.com are recommended for enterprise environments. Given the high detection rate among security engines and the use of anonymizing infrastructure, the remaining risk is classified as elevated. Continuous monitoring for shifts in hosting or additional blocklist inclusions is warranted, as this infrastructure may pivot to new domains or IP ranges to evade detection.