zor[.]gr[.]com

Analysis of zor.gr.com, observed on July 24, 2026, shows a live web service returning HTTP 200 and presenting the page title “Welcome.” The domain is delegated to four CentralNIC name servers (ns1‑ns4.centralnic.net) and was registered through Key‑Systems GmbH. Network resolution points to 104.21.48.103, an address owned by Cloudflare, Inc. in Canada, and the site presents a Google Trust Services / WE1 TLS certificate, indicating a valid HTTPS configuration that includes HSTS and HTTP/3 support. Cloudflare Browser Insights are also detected, suggesting the use of Cloudflare’s performance and security layer.

Threat intelligence flags the domain on three public security blocklists and records active blocks by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show four of ninety‑one antivirus engines flagging the domain, reinforcing the suspicion of malicious intent. The cumulative evidence aligns with the classification of a generic phishing site targeting unsuspecting users.

Uncertainties remain regarding the specific payload or credential‑harvesting mechanisms employed, as no detailed page content or login forms have been disclosed. Consequently, defenders cannot attribute a particular phishing kit or campaign beyond the generic label.

Recommendations: security teams should block DNS resolution to zor.gr.com and add the IP 104.21.48.103 to network‑level deny lists, acknowledging that the address is shared among many Cloudflare customers. Web filtering solutions should continue to flag the domain based on its blocklist status and the observed TLS certificate. Incident responders should monitor for any related indicators of compromise that reference this domain or its Cloudflare IP range, and update threat‑intel feeds to reflect its active, high‑risk posture.