ciaims-zora[.]com

Analysis indicates that the domain ciaims-zora.com was registered through GMO Internet, Inc. on April 23, 2025. The domain resolves to the Amazon‑hosted IP address 15.197.240.20, which is assigned to AS16509 (Amazon.com, Inc.) and is geolocated in the United States. No TLS certificate is presented for the host, and the site is currently taken offline, which is reflected in the HTTP status observed during the last scan. The domain is listed on a single security blocklist and has been explicitly blocked by the PhishDestroy service, confirming its classification as a malicious resource.

Reputation services assign extremely low trust scores: Scamadviser rates the domain at 1 / 100 and Gridinsoft at 0 / 100, indicating a high likelihood of abuse. VirusTotal reports that 14 of 95 scanned security vendors flag the domain as malicious, reinforcing the risk assessment. The infrastructure uses the nameservers ns1.verification-hold.suspended-domain.com and ns2.verification-hold.suspended-domain.com, which are commonly associated with recently suspended or hijacked domains. The stated scam type is “Brand Impersonation” and the domain is identified as impersonating the brand “zora”.

No SSL certificate, no visible page title, and no additional content analysis are available, leaving the exact malicious payload unknown. Defenders should immediately add ciaims-zora.com and its resolving IP 15.197.240.20 to network‑level block lists, enforce DNS sink‑holing, and monitor for any new domains that resolve to the same nameservers or Amazon‑hosted address space. Continuous re‑evaluation is advised in case the site becomes active again, and any incidents involving credential theft or brand‑related fraud should be correlated with this indicator.