zoras-xyz[.]pages[.]dev

The domain zoras-xyz.pages.dev was registered on February 21, 2026 and is currently hosted behind Cloudflare's network (ASN 13335). DNS resolution points to IP address 188.114.96.3, which belongs to Cloudflare, Inc., and the domain is served using Cloudflare's authoritative nameservers mitch.ns.cloudflare.com and gigi.ns.cloudflare.com. TLS termination is performed by Google Trust Services, presenting a certificate issued by the WE1 CA, and the site enforces HTTP Strict Transport Security (HSTS) while supporting HTTP/3. An HTTP request to the root URL returns a 403 status code, indicating that the server is refusing access to the requested resource.

The page title returned by the server is "Base is for everyone," which aligns with the declared impersonation target of the brand "base" in the intelligence feed. Google Safe Browsing classifies the domain as a social engineering threat, and two public phishing blocklists—PhishDestroy and ScamSniffer—have already listed the domain. Additional reputation data shows a Gridinsoft trust score of 0 out of 100, reflecting a severely low confidence rating. VirusTotal analysis reports three detections out of ninety-three scanning engines, confirming that multiple security vendors have flagged the domain as malicious.

The combination of brand‑specific page title, low trust score, blocklist presence, and multiple vendor detections supports the elevated risk rating assigned to the domain. Because the service is presently offline, deeper content analysis (e.g., HTML inspection, credential harvesting forms) cannot be performed at this time. Defenders should proactively block traffic to the domain and its associated IP address, add the domain to internal URL filtering lists, and monitor for any future re‑activation or related domains that resolve to the same Cloudflare IP range. Continuous observation of Google Safe Browsing and VirusTotal updates is advised to capture any changes in the threat posture.