web[.]defaazz[.]com

Analysis of web.defaazz.com indicates that the site is actively hosting a credential phishing campaign. The domain was registered on March 12, 2026 through Tucows Domains Inc. and is presently resolved to the IP address 172.67.183.141, which belongs to AS13335 Cloudflare, Inc. in the United States. The TLS certificate is issued by Google Trust Services under the WE1 label, and the site returns HTTP 200 with the page title "Defazz". The front‑end stack includes Vue.js, Highcharts, and HTTP/3 support, all delivered via a Cloudflare CDN.

Infrastructure observations show the domain is delegated to the nameservers karsyn.ns.cloudflare.com and pedro.ns.cloudflare.com. The IP address is shared across multiple unrelated sites, a common pattern for abuse clusters that exploit large CDNs to hide malicious activity. The site appears on three independent security blocklists and has been flagged by VirusTotal, with 17 of 95 security vendors marking the domain as malicious. Additional reputation signals include a Gridinsoft trust score of 0 out of 100 and explicit block listings by PhishDestroy, MetaMask, and SEAL.

While the available data confirms a high‑risk, active phishing operation, certain aspects remain uncertain. The exact phishing kit used is identified only as a generic credential phishing framework, and no explicit payload or credential‑harvesting endpoint has been captured in public feeds. The brevity of the site’s content (page title only) limits visibility into the full scope of the lure, and the shared CDN IP prevents precise attribution of the underlying host.

Defenders should block web.defaazz.com at the DNS and proxy layers, monitor outbound connections to the associated IP range, and enforce strict email filtering for messages that reference the "Defazz" brand or similar visual cues. Continuous re‑evaluation of threat intelligence feeds is advised, as the shared CDN infrastructure may host additional malicious sites that could be activated in the future.