sez[.]im

Analysis indicates that the domain sez.im is actively hosting a site titled “SEZIM - Ваш личный психолог онлайн”. The domain resolves to 104.19.241.93, which is a Cloudflare address located in the United States (AS13335). The site is served over HTTPS with a Let’s Encrypt certificate (YE1). DNS is delegated to three nameservers (ns1.ps.kz, ns2.ps.kz, ns3.ps.kz). Technical fingerprinting shows a Node.js stack built with Bubble and Express, and the page loads third‑party libraries from Yandex.Metrika, Unpkg, Slick, jsDelivr and includes Google reCAPTCHA. The domain appears on a single security blocklist and is currently blocked by PhishDestroy. VirusTotal reports two positive detections out of 91 scanners, and the Gridinsoft trust score is 0/100, reinforcing a high‑risk classification. Mail exchange records point to Google’s inbound mail servers (aspmx.l.google.com, alt1.as...). HTTP requests return a 200 status, confirming the site is reachable. The limited public intelligence does not reveal the exact payload or credential‑capture mechanisms; the page content beyond the title has not been examined. Defenders should add sez.im to web‑filtering and email‑gateway block lists, monitor outbound connections to the associated Cloudflare IP, and consider sink‑holing or DNS‑sink‑blocking of the three .ps.kz nameservers. Continuous re‑scanning with multi‑engine services is advised to detect any new malicious changes.