zor[.]net

This domain, zor.net, is currently flagged as an active phishing infrastructure with a high-risk classification. Registered on April 17, 2026, through a widely used registrar, the domain remains operational as of July 12, 2026. Infrastructure analysis reveals it resolves to 15.197.148.33, an address associated with AWS Global Accelerator in California. The use of cloud-based hosting is consistent with observed patterns in phishing campaigns, where threat actors leverage scalable and resilient infrastructure to evade takedowns. Technical indicators further support the domain's suspicious nature. The domain appears on one security blocklist and is flagged by three out of ninety-five security vendors in aggregated scanning results. While the exact content of the site has not yet been analyzed, the presence of MX records pointing to smtp.secureserver.net suggests potential email-based abuse, a common vector for credential harvesting or malware distribution. The SSL certificate, issued by a well-known certificate authority, does not mitigate the risk, as legitimate certificates are frequently exploited to lend false credibility to malicious sites. Defenders should note that the domain's nameservers, ns55.domaincontrol.com and ns56.domaincontrol.com, are consistent with those used by the same registrar for other domains, some of which have been previously linked to phishing activity. The domain's trust score of 0 out of 100, combined with its inclusion in one threat intelligence pulse, reinforces the need for caution. While the specific target or brand impersonated remains unconfirmed, the domain's infrastructure and detection history warrant immediate blocking at the network level. Organizations are advised to monitor for connections to this domain and investigate any associated email or web traffic for signs of compromise.