tazororaretirement[.]co[.]zw

The domain tazororaretirement.co.zw is actively being used for a generic phishing campaign as of the report date, July 29, 2026. VirusTotal analysis shows that 11 of 91 scanned security vendors have flagged the domain, indicating a moderate level of consensus among detection engines. Google Safe Browsing classifies the site under social engineering, and the domain is explicitly blocked by the PhishDestroy mitigation service.

Infrastructure assessment reveals that the domain resolves to the single IPv4 address 192.138.189.196, and its authoritative name servers are ns1.webzim.net and ns2.webzim.net, suggesting the hosting environment is provided by the WebZim service. The domain appears on one external security blocklist, reinforcing the observed malicious intent. The risk rating assigned is high, and the operational status remains active.

Evidence confirms that the domain is currently being leveraged to lure victims, but no public page content, SSL details, or HTTP response codes have been disclosed, leaving the exact phishing vector and targeted brand unspecified. Consequently, defenders should treat the domain as hostile and enforce immediate mitigation steps: add the domain and its resolved IP address to network and endpoint blocklists, monitor DNS queries for related lookups, and consider sinkholing the IP if feasible. Continuous re‑evaluation is advised, as additional detection signatures or blocklist entries may emerge, providing further insight into the campaign’s scope and methodology.