zaflen[.]com

Analysis of zaflen.com, observed as a generic phishing site, indicates that the domain was registered on 21 February 2026 through Web Commerce Communications Limited and is hosted behind Cloudflare (AS13335) with the public address 104.21.33.164 located in the United States. The zone is served by the Webnic name servers ns100.webnic.cc and ns101.webnic.cc. The site presented the page title “ZAFLEN | Open the world of luck and rewards!” before being taken offline; the current HTTP status is reported as offline. Threat intelligence sources have classified the domain as a generic phishing infrastructure and have recorded a risk level of elevated.

The domain appears on a single security blocklist and has been actively blocked by the PhishDestroy sinkhole. VirusTotal scans show that three of ninety‑five antivirus engines flagged the domain, confirming malicious intent despite the low overall detection count. The SSL certificate in use is identified as “WE1”, which is consistent with Cloudflare‑issued certificates for this host. Evidence gaps remain regarding the specific payload delivered to victims, the credential‑ harvesting mechanism, and any associated command‑and‑control endpoints, as no further content analysis has been published.

Defenders should ensure that outbound connections to 104.21.33.164 are denied or monitored, enforce DNS filtering to block zaflen.com, and add the domain to internal phishing blocklists. Continuous monitoring of the registrar Web Commerce Communications Limited and the associated name servers is recommended to detect any rapid re‑registration or redeployment of the domain. Given the elevated risk rating and the existing blocklist entry, the domain should be treated as hostile until a formal takedown confirmation is received.