zyexx[.]com

This domain, zyexx.com, is currently active and serves a social‑media phishing campaign that presents itself under the page title “CybeReady”. The site is hosted behind Cloudflare’s network (AS13335) and resolves to the IP address 172.67.73.221, which is geolocated to the United States. Registration details show the domain was created on 12 February 2018 and was registered through Cloudflare, Inc., with authoritative name servers mona.ns.cloudflare.com and sean.ns.cloudflare.com. TLS termination is provided by Google Trust Services using the WE1 certificate chain, indicating a valid, publicly trusted SSL certificate. An HTTP GET returns status code 200, confirming that the web service is reachable.

Threat intelligence sources have repeatedly flagged the domain. AlienVault OTX lists the domain in sixteen separate pulses, and VirusTotal reports nine of ninety‑three scanned scanners assigning a malicious label. The domain is listed on at least one public blocklist and has been blocked by the PhishDestroy sinkhole, demonstrating active mitigation by third‑party defenses. The presence of a Cloudflare‑issued SSL certificate and the use of Cloudflare’s DNS infrastructure are common tactics to obscure the true origin of malicious infrastructure. Open questions remain because the page content has not been captured; the specific social‑media platform or credential‑harvesting form used by the site is not publicly documented.

Analysts should therefore treat any traffic to zyexx.com as hostile, enforce URL filtering, and consider adding the IP address 172.67.73.221 to network‑level deny lists. Continuous monitoring of related Cloudflare‑hosted sub‑domains is advised, as threat actors frequently rotate hosts within the same CDN. Updating endpoint protection with the latest signatures that include the nine VirusTotal detections will improve detection rates. Defensive teams should also monitor OTX and other threat‑intel feeds for new pulses referencing zyexx.