zurafasokakta[.]icu

The domain zurafasokakta.icu was registered on April 11, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED. DNS resolution points to the IP address 188.114.96.3, which is hosted by Cloudflare, Inc. and geolocated to Canada. The domain is delegated to the Cloudflare nameservers aiden.ns.cloudflare.com and veda.ns.cloudflare.com, and it presents a valid TLS certificate issued by Let’s Encrypt (certificate identifier E8). An HTTP 301 redirect is observed, and the page title returned from the server is "Bakım | Zürafa Sokak".

VirusTotal analysis shows that 7 of 95 security vendors have flagged the domain, indicating a modest but notable detection rate. The domain currently appears on a single security blocklist and has been referenced in one AlienVault OTX pulse. Gridinsoft assigns a trust score of 0 out of 100, and the site is actively blocked by the PhishDestroy service. These indicators collectively suggest a high‑risk posture consistent with generic phishing activity.

The available evidence points to a phishing infrastructure that likely targets users of the Zürafa Sokak brand, as implied by the page title. However, the exact content and credential‑harvesting mechanisms have not been publicly disclosed, leaving the precise attack vector uncertain. The presence of a legitimate TLS certificate and Cloudflare front‑end may be employed to increase perceived trustworthiness and to obfuscate the true location of the malicious server.

Defenders should add zurafasokakta.icu to URL filtering and domain block lists across enterprise gateways, monitor DNS queries for the associated IP address 188.114.96.3, and enforce strict TLS inspection policies to detect potential content manipulation. Incident response teams should also query threat‑intel feeds for any emerging indicators related to this domain, and consider sharing any newly observed artifacts with collaborative platforms to improve collective detection capabilities.