zama[.]best

The domain zama.best was registered on March 11, 2026 through Sav.com, LLC. Since its creation it has appeared on three security blocklists, including PhishDestroy, MetaMask, and SEAL. The site presents a TLS certificate issued by Google Trust Services under the WE1 designation, indicating a valid HTTPS connection despite the malicious intent.

Infrastructure analysis shows the domain resolves to IP address 104.21.83.215, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. DNS resolution is handled by the Cloudflare authoritative nameservers arturo.ns.cloudflare.com and venus.ns.cloudflare.com. An HTTP request to the host returns a 403 status code, and the page title reported by scanners is "Just a moment…". The Gridinsoft trust score for the domain is 0 out of 100, reflecting an extremely low reputation.

Threat intelligence feeds indicate a high‑risk classification as generic phishing. VirusTotal scans have flagged the domain in five out of ninety‑five security vendors, and AlienVault OTX references the domain in one pulse. The combination of blocklist listings, low trust score, and detection by multiple vendors supports the high‑risk rating. However, the exact phishing payload or targeted brand cannot be confirmed from the available data, as the "Just a moment…" page may be a redirection placeholder used by the operators.

Defenders should add zama.best to network and email blocklists, enforce DNS sinkholing, and monitor for any traffic to the associated Cloudflare IP range. Continuous re‑scanning of the domain is advised, as the underlying content could change rapidly. Incident response teams should treat any credentials submitted to the site as compromised and advise affected users to reset passwords immediately.