prozonecc[.]net

prozonecc.net is currently active and serves a credential‑phishing page whose HTML title reads “Prozone | Prozone.cc | Prozone.cc Shop | Prozone cc Login”. The site returns an HTTP 302 redirect, indicating it may forward victims to a secondary landing page after initial contact. TLS termination is performed by a Google Trust Services certificate identified as “WE1”, which is commonly used by Cloudflare‑proxied services and does not by itself imply malicious intent. The domain resolves to 188.114.96.3, an address owned by AS13335 Cloudflare, Inc. in the United States, and uses Cloudflare’s DNS resolvers adi.ns.cloudflare.com and lex.ns.cloudflare.com. The hosting stack includes Cloudflare Browser Insights and HTTP/3, consistent with the observed Cloudflare front‑end.

The domain was registered on 21 February 2026 through NiceNIC International Group Co., Limited, and the registrar information is publicly visible. Gridinsoft assigns a trust score of 0 / 100, reflecting a lack of benign reputation. The domain appears on a single security blocklist and has been flagged by PhishDestroy as a credential‑phishing site. VirusTotal analysis shows that three of ninety‑three scanning engines have reported the domain as malicious, providing additional independent confirmation of its threat level. The available intelligence confirms that the primary malicious objective is credential harvesting, but the specific target brand beyond the “Prozone” naming in the page title is not independently verified.

No additional indicators such as malware payload hashes, phishing email samples, or victim reports are currently available, leaving the full scope of the campaign uncertain. Defenders should block outbound connections to 188.114.96.3, add the domain to DNS sinkhole lists, and ensure that web filtering solutions flag any HTTP request to prozonecc.net.