zov[.]squidvr[.]com

Analysis indicates that the domain zov.squidvr.com was registered on 21 February 2026 through Dynadot LLC and is served exclusively from Cloudflare’s network (AS13335, United States). The authoritative nameservers lady.ns.cloudflare.com and rocky.ns.cloudflare.com resolve the domain to the IPv4 address 104.21.53.189, which is associated with Cloudflare’s edge infrastructure and supports HTTP/3. An SSL certificate issued by Google Trust Services (WE1) secures the connection, and an HTTP 403 response is returned when the site is accessed, suggesting the content is currently inaccessible. VirusTotal reports that eight of ninety‑three scanned security vendors flagged the domain, and Google Safe Browsing classifies it as a social‑engineering threat.

Independent blocklists PhishDestroy and ScamSniffer have also listed the domain, bringing the total number of public blocklists to two. The Gridinsoft trust score is 0 out of 100, reinforcing the assessment of malicious intent. The page title presented by the server is “Suspected phishing site | Cloudflare”, which aligns with the generic phishing classification. Because the site is presently taken offline, direct inspection of the payload, credential‑capture mechanisms, or targeted brand is not possible.

Consequently, the precise lure or victim profile remains uncertain. Defenders should proactively block traffic to the IP address 104.21.53.189 and to the domain itself at the DNS layer, incorporate the domain into internal phishing‑filtering rules, and monitor for any rapid re‑registration or replica infrastructure. Continuous observation of Cloudflare‑hosted sub‑domains and related nameserver entries is advised, as threat actors frequently leverage the same edge services for future campaigns.