zoratwo[.]pages[.]dev

The domain zoratwo.pages.dev is identified as a high-risk generic phishing site. The site's title 'Zora bridge' suggests it's potentially masquerading as a legitimate service, attempting to deceive users into divulging sensitive information. No specific brand or drainer kit has been directly associated with this domain, but its phishing nature indicates a likely intent to exploit user trust.

Technical analysis of zoratwo.pages.dev reveals several concerning indicators. The domain resolves to IP address 172.66.44.131 and is registered through Cloudflare, Inc. It was created on April 01, 2026, and is flagged by 3 out of 95 security vendors on VirusTotal. The site is also listed on 2 security blocklists, further highlighting its malicious intent. The SSL certificate is issued by Google Trust Services / WE1, which may provide a false sense of security to unsuspecting users. The IP location is traced to Canada, under the control of Cloudflare, Inc.

Currently, the domain remains active, despite being blocked by security services such as PhishDestroy and ScamSniffer. This ongoing activity indicates that the threat posed by zoratwo.pages.dev is still present, necessitating continuous monitoring and swift action to mitigate any potential risk to users. Users are advised to remain vigilant and employ comprehensive security measures, including updated antivirus software and secure browsing practices, to protect against potential phishing attempts.