zuonox[.]com

Analysis of zuonox.com, first observed on July 30, 2026, indicates that the domain is being used in a generic phishing campaign. The domain resolves to the IP address 172.67.193.239, which is hosted on Cloudflare infrastructure as evidenced by the authoritative name servers karl.ns.cloudflare.com and sharon.ns.cloudflare.com. Registration information lists Fewmoretaps OU d/b/a Trustname.com as the registrar. The domain has been added to one public security blocklist and is currently flagged by the PhishDestroy sinkhole, confirming active malicious use.

VirusTotal reports that the domain was scanned by 91 antivirus and URL scanning engines, none of which raised a detection at the time of analysis; this absence of detections does not constitute evidence of benign behavior. No additional data on SSL certificate details, HTTP response codes, Safe Browsing status, or Open Threat Exchange (OTX) sightings are available. Consequently, the confidence level of the phishing classification relies on the observed hosting, blocklist inclusion, and sinkhole detection.

Defenders should continue to block traffic to zuonox.com at perimeter and DNS layers, monitor for any new indicator updates, and consider adding the domain to internal blocklists. Ongoing investigation is required to determine the specific payload or credential‑harvesting technique employed, and to identify any associated command‑and‑control endpoints. Until further evidence is gathered, the domain remains classified as an active generic phishing threat under investigation.