zenvestcapvialimited[.]ltd

Analysis of zenvestcapvialimited.ltd, observed on 24 July 2026, shows a confirmed brand‑impersonation campaign targeting Coinbase users. The site returned HTTP 200 and presented the page title “Bot Verification”, a common lure for credential harvesting. Technical fingerprinting reveals a Python/Django stack served behind LiteSpeed with HTTP/3 enabled, and client‑side libraries including jQuery, Smartsupp, GetButton and enforced HSTS. The domain resolves to 198.251.89.220, an address owned by AS53667 (FranTech Solutions) located in the United States.

DNS records list an MX entry pointing to the domain itself and authoritative nameservers ns27.asurahosting.com and ns28.asurahosting.com. Registration data indicate the domain was created on 9 July 2025 through NameCheap, Inc., and the TLS certificate is a Let’s Encrypt R12 issuance, which is currently valid. The domain appears on a single blocklist, PhishDestroy, and one of ninety‑five VirusTotal scanners flagged it as malicious. Gridinsoft assigned a trust score of 0 / 100, reinforcing the malicious assessment.

The campaign uses the “Verification Scam” kit, consistent with the “Bot Verification” page title, and explicitly impersonates Coinbase. No additional public intelligence such as OTX or Safe Browsing entries is available, and the site is presently taken offline, limiting real‑time observation. Defenders should add the domain and its associated IP address to blocklists, monitor traffic for HTTP/3 connections to the host, and enforce detection of outbound requests to Let’s Encrypt‑issued sites with similar technology stacks. Email gateways should inspect MX records that resolve to the same domain, and security teams should update indicator‑of‑compromise (IOC) feeds with the registrar, nameserver, and certificate details to prevent future re‑use of the infrastructure.