v2r[.]wwwzls[.]pp[.]ua

This domain, v2r.wwwzls.pp.ua, is actively flagged as a high-risk phishing site targeting the World Trade Organization (WTO), as indicated by its page title 'World Trade Organization - Home page - Global trade.' Infrastructure analysis reveals the domain is hosted on Cloudflare (AS13335) with an IP address of 172.67.218.210, resolving through nameservers emerie.ns.cloudflare.com and newt.ns.cloudflare.com. The domain is registered under NIC.UA LLC and has been blocked by two security blocklists, PhishDestroy and PhishingDB, with a Gridinsoft trust score of 0/100. Sixteen of 95 security vendors on VirusTotal have flagged this domain, though the exact nature of the detections remains unverified without deeper payload analysis. Technologies detected include jQuery, Cloudflare, Alibaba Cloud CDN, and HTTP/3, which are consistent with modern phishing infrastructure but not inherently malicious. The SSL certificate is issued by Google Trust Services (WE1), providing encrypted connections that may lend credibility to the phishing attempt. The site remains active as of July 12, 2026, with an HTTP 200 status, indicating no immediate takedown or server-side blocking. Defenders should treat this domain as a confirmed phishing threat targeting WTO credentials or related financial data. Immediate action is recommended, including blocking the domain and IP at the network level, monitoring for internal traffic to this endpoint, and alerting users to the risk of credential harvesting. Further investigation into the phishing kit or payload is advised to determine if additional indicators of compromise (IOCs) exist, such as embedded malicious scripts or redirect chains. Given the use of Cloudflare, traditional geofencing or IP-based blocking may be less effective, necessitating DNS-level or application-layer filtering.