zenvria[.]com

This domain, zenvria.com, is confirmed to operate as a credential phishing infrastructure specifically targeting Microsoft users. The site presents a fraudulent login interface designed to harvest account credentials by impersonating Microsoft authentication pages. Analysis of the page title, 'Verifying your connection...,' suggests an attempt to mimic legitimate security verification processes, increasing the likelihood of user deception. The domain is engineered to exploit trust in Microsoft's brand, potentially leading to unauthorized access to corporate or personal accounts, data breaches, and subsequent malicious activities such as lateral movement or financial fraud. Infrastructure analysis reveals multiple technical indicators supporting the phishing classification. The domain was registered on August 20, 2025, through HOSTINGER operations, UAB, and resolves to the IP address 78.111.85.162, located in the Netherlands under AS208951 (ITGLOBAL.COM). At the time of assessment, 19 out of 95 security vendors on VirusTotal flagged zenvria.com as malicious. The domain appears on two independent security blocklists and is currently offline. Notably, the site lacks an SSL certificate, which is atypical for legitimate authentication portals and further signals its fraudulent nature. Users who visited zenvria.com should immediately assume their credentials may have been compromised. Affected individuals should change their Microsoft account passwords using a secure device and enable multi-factor authentication if not already active. Security teams should revoke any active sessions associated with the account and monitor for unauthorized access or anomalous activity. Organizations are advised to block the domain and its associated IP address (78.111.85.162) at the network perimeter to prevent further exposure. If corporate credentials were entered, internal IT teams should be notified to conduct a forensic review of the affected account and systems.