zhrmw[.]com

Analysis indicates that the domain zhrmw.com was registered on 21 February 2026 through Gname.com Pte. Ltd. and is currently pointing to the Cloudflare address 104.21.86.245, which belongs to AS13335 Cloudflare, Inc. in the United States. The domain resolves to a web server protected by Cloudflare, uses Cloudflare’s DNS (rafe.ns.cloudflare.com, rocky.ns.cloudflare.com) and presents a TLS certificate issued by Google Trust Services under the “WE1” label. The public page title returned by the site when it was online was “OFFICIAL MINING,” a wording often associated with unsolicited cryptocurrency or mining schemes. The site also loaded Facebook Pixel and Cloudflare Browser Insights scripts and negotiated HTTP/3 connections, indicating a modern web stack but offering no additional context about the payload.

Threat intelligence shows that zhrmw.com appears on a single security blocklist and has been flagged by PhishDestroy as a malicious resource. On VirusTotal, one of ninety‑three scanning engines reported a detection, confirming that at least one security vendor identified suspicious behavior. No further detail on the specific detection is available from the supplied data. The domain is presently offline, which limits real‑time verification of content but does not eliminate the risk posed by the previously observed infrastructure.

Given the combination of a recent registration, use of reputable CDN services, a TLS certificate from Google, and the presence of a page title suggesting “official mining,” the observable evidence aligns with a generic phishing campaign that likely attempts to lure users into providing credentials or installing unwanted software. Defenders should continue to block the domain at perimeter filters, monitor DNS queries for the associated Cloudflare IP range, and update any threat‑intel feeds with the observed indicators (domain name, IP address, nameservers, TLS fingerprint, and the “OFFICIAL MINING” title).