uat[.]zro[.]app

This domain, uat.zro.app, is confirmed to operate as a credential harvesting phishing portal under the guise of a Customer Onboarding Platform. Analysis indicates the site specifically targets authentication workflows, likely impersonating legitimate business onboarding services to capture corporate credentials. The domain currently remains offline following enforcement actions, though its infrastructure has not been fully dismantled. Technical indicators reveal the domain was registered through GoDaddy.com, LLC on February 21, 2026, and resolves to IP address 43.205.58.135 hosted on Amazon.com, Inc. infrastructure (AS16509) in India. Security vendor analysis shows 18 of 95 detection engines on VirusTotal flagged the domain as malicious, while Google Safe Browsing classifies it as a phishing threat. The domain appears on two independent security blocklists (PhishDestroy and PhishingDB) and uses a Let's Encrypt SSL certificate (R13) to create an appearance of legitimacy. The page title 'Customer Onboarding Platform' suggests targeting of enterprise users during account creation or verification processes. Current status shows the domain has been taken offline, though residual risk remains from potential infrastructure reuse. Organizations should implement immediate countermeasures including: adding the domain and associated IP to internal blocklists, reviewing authentication logs for connections to 43.205.58.135 during the active period, and monitoring for similar subdomain patterns under zro.app. Security teams should also investigate potential credential exposure among employees who may have interacted with the portal, particularly those involved in customer onboarding workflows. The February 2026 registration date indicates this campaign was likely planned well in advance of deployment.