zorwex[.]com

The domain zorwex.com was registered on 21 February 2026 through Atak Domain Bilgi Teknolojileri A.S. and is hosted on Cloudflare infrastructure, as indicated by its nameservers eloise.ns.cloudflare.com and nicolas.ns.cloudflare.com. DNS resolution points to IP address 172.67.155.211, which belongs to AS13335 Cloudflare, Inc. and is geolocated to the United States. The site presents a Cloudflare‑issued SSL certificate signed by Google Trust Services under the WE1 designation, and HTTP requests return a 403 status code, suggesting that access is currently denied.

VirusTotal analysis recorded 12 detections out of 93 scanned security vendors, and the domain appears on a single security blocklist. PhishDestroy has taken the site offline, and the current operational status is reported as offline. Additional reputation data shows a Gridinsoft trust score of 0 out of 100, reinforcing the malicious assessment. The page title returned by the server is "Suspected phishing site | Cloudflare," confirming that the site is being flagged by the hosting provider.

The campaign is classified as social media phishing, though the specific target platform or credential capture method has not been disclosed. Defenders should block the domain and its associated IP address, monitor for any future re‑registration attempts, and incorporate the observed indicators—registrar, nameservers, IP, SSL issuer, and detection counts—into threat‑intel feeds. Ongoing vigilance is advised to detect any derivative infrastructure that may reuse the same Cloudflare edge or registrar footprint.