prozone[.]es

prozone.es has been identified as a credential phishing site. The page served at the root URL returns HTTP 200 and displays the title “Prozone: Prozone login | Prozone CC”, which mimics a legitimate corporate login portal. The domain was registered on March 24, 2026 and resolves to the IP address 173.211.81.11, which is geolocated to the United States according to public lookup services. DNS resolution is handled by three dnspod.com name servers (a.dnspod.com, b.dnspod.com, c.dnspod.com), a pattern frequently observed in rapidly provisioned malicious infrastructure.

Infrastructure analysis shows the site runs on a Node.js stack with Vue.js, Nuxt.js, LiteSpeed, and jQuery components, and supports HTTP/3. The TLS certificate is issued by Let’s Encrypt (R13), indicating a free, automatically renewed certificate. A Gridinsoft trust score of 0 out of 100 further corroborates the malicious nature of the host. The domain appears on a single security blocklist and is actively blocked by PhishDestroy, confirming that defensive feeds have already flagged it as abusive.

Threat intelligence classifies the activity as credential phishing. The presence of a login‑styled page, combined with the low trust score and the fact that 1 of 95 VirusTotal scanners flagged the domain, provides concrete evidence that the site is intended to harvest user credentials. No additional malicious payloads or secondary infrastructure have been observed, leaving the broader campaign scope uncertain.

Defenders should add 173.211.81.11 and the domain prozone.es to network deny lists and monitor DNS queries for the associated dnspod.com name servers. Email gateways should be configured to block messages that reference the “Prozone login” branding, and users should be warned that the site is not affiliated with any legitimate Prozone service. Continuous observation of the IP and any newly observed subdomains is recommended to detect potential expansion of the phishing infrastructure.