# staking-zama.xyz — Recorded security evidence | PhishDestroy

Content language: English
Canonical HTML report: https://phishdestroy.io/domain/staking-zama.xyz/
Machine-readable companion: https://phishdestroy.io/domain/staking-zama.xyz/llm.txt

## Summary

PhishDestroy stores a threat-intelligence record for this domain.
This document reports the latest stored fields; it is not a real-time guarantee of availability or safety.

## Stored observations

- Listed by PhishDestroy: yes
- Availability at last stored check: not observed active
- First observed by PhishDestroy: 2026-09-29 03:06:50 UTC
- Last availability or vendor check: 2026-10-29 02:32:27 UTC
- Stored record updated: 2026-10-30 13:31:41 UTC
- VirusTotal detections in the stored snapshot: 4/92
- Independent public blocklist matches in the stored snapshot: 2
- Matching public blocklists: MetaMask, SEAL
- Google Safe Browsing stored result: checked_clean

## Stored labels and detections

- Automated brand label (collector metadata; not a confirmed impersonation finding): MetaMask

## Stored infrastructure

- Observed IP address: 172.67.187.2
- Registrar in stored WHOIS data: Eranet International Limited
- Registrar country in stored WHOIS data: US
- Registration date (registry RDAP, staking-zama.xyz): 2026-09-27 20:25:20 UTC

## Evidence links

- URLScan report: https://urlscan.io/result/01a0eb23-5454-72fd-873d-c4f8271788c0/
- VirusTotal domain view: https://www.virustotal.com/gui/domain/staking-zama.xyz
- Certificate Transparency search: https://crt.sh/?q=%25.staking-zama.xyz
- Web Archive lookup: https://web.archive.org/web/*/https://staking-zama.xyz/

## Corrections

- Appeal or correct this record: https://phishdestroy.io/appeals/
- Methodology and help: https://phishdestroy.io/faq

## Public report package

PhishDestroy stores a record for staking-zama.xyz. Source observations are dated separately; missing checks do not establish safety.

PhishDestroy stores a record for staking-zama.xyz. Source observations are dated separately; missing checks do not establish safety.

A reviewed analysis is not available for this text revision. Consult the dated source records below.
Package revision: c13b07d4858ff6f6f49297c5cef8c0975a8d2be1f3540a1456b5ab21ce2ca1fd
Source facts (timestamps as stored): {"record_id":1412491,"first_recorded_at":"2026-09-29 05:06:50","virustotal":{"source":"VirusTotal","scope":"unknown","result_state":"complete","numerator":4,"denominator":92,"malicious":2,"suspicious":2,"vendors":{"CRDF":"malicious","SOCRadar":"suspicious","alphaMountain.ai":"suspicious","Forcepoint ThreatSeeker":"phishing"},"observed_at":"2026-10-14T06:44:27Z","checked_at":"2026-09-29 05:08:35","fetched_at":"2026-10-21T16:44:01Z","time_basis":"UTC (provider ISO timestamps)","stored_summary":{"source":"VirusTotal","scope":"unknown","result_state":null,"numerator":2,"denominator":91,"malicious":null,"suspicious":null,"vendors":["CRDF","Forcepoint ThreatSeeker"],"observed_at":null,"checked_at":"2026-09-29 05:08:35","fetched_at":null,"time_basis":"as stored; legacy timezone not established"}},"google_safe_browsing":{"source":"Google Safe Browsing","state":"checked_clean","verdict":0,"checked_at":"2026-09-29 05:08:52"},"spamhaus":{"source":"Spamhaus","verdict":null,"checked_at":"2026-09-29 08:30:29"},"availability":{"source":"stored HTTP observation","state":"dead","observed_at":"2026-10-29 03:32:27"}}

## Stored page captures

- Primary capture: https://i.ibb.co/qY2chRyB/3ad33c8cded5.png
  Captured: 2026-09-29 03:10:44 UTC
- URLScan capture 1: https://screenshots.phishdestroy.io/01a0eb23-5454-72fd-873d-c4f8271788c0.png
  Captured: 2026-09-29 03:10:44 UTC
  Source report: https://urlscan.io/result/01a0eb23-5454-72fd-873d-c4f8271788c0/
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e6c7-0f15-70c3-a809-5c19dd7156b8.png
  Captured: 2026-09-28 06:50:07 UTC
  Source report: https://urlscan.io/result/01a0e6c7-0f15-70c3-a809-5c19dd7156b8/
  SHA-256: 63363965fb48a5c2cd43e5e2a2f06fe066ec197fde2ad8ce4087b86cd7f1c35e
- URLScan · 2026-09-28: https://screenshots.phishdestroy.io/us/01a0e6c7-0e71-7081-8156-be57795178d7.png
  Captured: 2026-09-28 06:50:06 UTC
  Source report: https://urlscan.io/result/01a0e6c7-0e71-7081-8156-be57795178d7/
  SHA-256: 63363965fb48a5c2cd43e5e2a2f06fe066ec197fde2ad8ce4087b86cd7f1c35e
- URLScan · 2026-09-29: https://screenshots.phishdestroy.io/us/01a0eb26-fd46-739c-8436-43e6b667224d.png
  Captured: 2026-09-29 03:13:23 UTC
  Source report: https://urlscan.io/result/01a0eb26-fd46-739c-8436-43e6b667224d/
  SHA-256: 63363965fb48a5c2cd43e5e2a2f06fe066ec197fde2ad8ce4087b86cd7f1c35e
- Cloudflare Radar: https://screenshots.phishdestroy.io/cf/32a9cdb6-6fdb-4f8c-bc89-af36b2937dcd.png
  Captured: 2026-09-29 03:09:06 UTC
  Source report: https://radar.cloudflare.com/scan/32a9cdb6-6fdb-4f8c-bc89-af36b2937dcd
  SHA-256: 6d6ff466af8848eabaf66c6918d355fac9d383c0f19e2b2802ae3bd01b19aff1
- URLQuery: https://screenshots.phishdestroy.io/uq/1646ec12-34ff-431e-bbda-804c21d1898c.png
  Source report: https://urlquery.net/report/1646ec12-34ff-431e-bbda-804c21d1898c
  SHA-256: 7ddb6038a2d13b798fa5a6f2b87ec971c30f40db5212e1d4fa46974bc3abdc7f

## Collected source observations

Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator.
```json
{
    "urlscan": {
        "v": 1,
        "fetched_at": "2026-10-20T20:55:07Z",
        "uuid": "01a0eb23-5454-72fd-873d-c4f8271788c0",
        "scanned_at": "2026-09-29T03:09:22Z",
        "final_url": "https://staking-zama.xyz/",
        "status": 200,
        "redirected": "https-only",
        "redirects": [
            {
                "to": "https://staking-zama.xyz/",
                "from": "http://staking-zama.xyz/",
                "status": 307
            }
        ],
        "ip": "2606:4700:3031::ac43:bb02",
        "domains": [
            "gateway.irys.xyz",
            "esm.sh",
            "arbitrum.meowrpc.com",
            "arbitrum.gateway.tenderly.co",
            "arbitrum.drpc.org",
            "rpc.ankr.com",
            "arbitrum-one.publicnode.com",
            "arb1.arbitrum.io",
            "fonts.gstatic.com",
            "5jrjgp2nl37gpefz75hgo6idl2q2frezh2ewvezllzssodeldc3a.mainnet-1.datasprite-cdn.com",
            "hxjnnbfgmzureusmhjgltavcqubaut2yzqx23rrlalgrwm4nynga.mainnet-1.datasprite-cdn.com",
            "7hle7g76hwhzkcgcytuleelhk7lwp5k2ivnywsyp5umgak26bktq.mainnet-1.datasprite-cdn.com",
            "abnsx7str6j5sa3pdbm5r66xojf3es2dyofcb7tsun2spudnhioq.mainnet-1.datasprite-cdn.com",
            "l2kourp7xt2ar7nw3fpgqmxu3mvfli4qxvsvx3cacditkaifq6rq.mainnet-1.datasprite-cdn.com",
            "crwj4ebgvb7k4zcwmmxrnzxbs2gaegjyku7rc4eqjkvdnsvrehsa.mainnet-1.datasprite-cdn.com",
            "y2me6bz5xzrin5vis76bc53hqcyzeg6ccrbutd74zgrtsncobg6q.mainnet-1.datasprite-cdn.com",
            "rahqtny5jec73ifzc2gg5x3d5s6bznpxhj4g3ky25pp5g2l7y7pq.mainnet-1.datasprite-cdn.com",
            "4xy5hycubobxyykm63sfnbkjznatsbung7ttetuoehkqf7ozquma.mainnet-1.datasprite-cdn.com",
            "qofpup6nmdjajko4dxgkt5mq2htvoe4uqxfbycxyrybfw7p5to7a.mainnet-1.datasprite-cdn.com",
            "7ohnisscwweqylohacphls5cmyhfuuworva4o7nypw42xdl6i63a.mainnet-1.datasprite-cdn.com",
            "b6ktecz7yjy6fzgzlivivwfm4xtjvavuqbddceaslq46lxbuw2wq.mainnet-1.datasprite-cdn.com",
            "muyovc3b2336fg4hlwg73n6w7lve6xi5wwagbq3mkm34hz3fufcq.mainnet-1.datasprite-cdn.com",
            "3zda2p33cro63eoev6gcult7nzm6vegrll7kg6cknocqfq4tavva.mainnet-1.datasprite-cdn.com",
            "el2hrgbroeyi4qgvgvj2lqoggwyiygesvezu3i5thvntgjewgylq.mainnet-1.datasprite-cdn.com",
            "tuahnjjbd4ptq2z3dq73mmxdcdpdxt5sjs4uwfluwoxw2i3zrv4q.mainnet-1.datasprite-cdn.com",
            "h5mmvwl7o3g5kseh6ibvzgyebxak4j4qgqqczbevmgdtkhvbbhaq.mainnet-1.datasprite-cdn.com",
            "fd7xqs6fnkfawh6qvkmjuuwvub4cbuycyxx3q3romqtbcbt6o4kq.mainnet-1.datasprite-cdn.com",
            "qyxbba7uefsmigd4oki3zm3hcmilt5fjudhha7n37oeygwrgdcua.mainnet-1.datasprite-cdn.com",
            "lipjimvtizvuyifeddgmjfapysx6npsrkjjwfy5zxmvkhkoal6ea.mainnet-1.datasprite-cdn.com",
            "ch75ckxualkloc7t5fsfem56e5odt55sl7lel66ksibigpvzxsda.mainnet-1.datasprite-cdn.com"
        ],
        "ips": [
            "2a00:1450:4001:c17::5e",
            "2606:4700:3037::ac43:a31a",
            "2606:4700:3035::6815:f9e",
            "2606:4700:10::6814:1faa",
            "2a00:1450:4001:c13::5f",
            "104.26.12.205",
            "2606:4700:20::ac43:46de",
            "2a04:4e42::485",
            "2606:4700:3037::6815:11cb",
            "104.26.11.181",
            "35.227.193.242",
            "2606:4700::6812:a3b",
            "2605:6441:1:439::",
            "2606:4700:10::ac42:96a2",
            "2606:4700:10::ac42:ab2d"
        ],
        "asns": [
            "15169",
            "13335",
            "54113",
            "396982",
            "396356"
        ],
        "countries": [
            "DE",
            "US"
        ],
        "link_domains": [
            "www.zama.org",
            "app.zama.org",
            "dune.com",
            "www.blog.blockscout.com",
            "docs.zama.org",
            "staking.zama.org",
            "bridge.zama.org",
            "status.zama.org",
            "github.com",
            "x.com",
            "t.me",
            "www.linkedin.com",
            "jobs.zama.org"
        ],
        "social": [
            "https://github.com/zama-ai",
            "https://github.com/zama-ai/awesome-zama",
            "https://x.com/zama",
            "https://t.me/zama_on_telegram"
        ],
        "doc_hash": "28be9c1877b32c3af4fe1c50db1fbb0e5f84b6ccb24bfb838f9beab3eb317634",
        "script_hashes": [
            "3b140ada1b7c80c5c61b809b0c131ac6e2613610f1f8e33934b6e3483d56f126"
        ],
        "globals": [
            "requestResize",
            "__earlyClickAction",
            "__removeEarlyClick",
            "Cap",
            "downloadLogsBlobInBrowser"
        ],
        "cookies": [
            "PHPSESSID"
        ],
        "tls": {
            "san": [
                "*.staking-zama.xyz",
                "staking-zama.xyz"
            ],
            "cipher": "AES_128_GCM",
            "issuer": "YE2",
            "subject": "staking-zama.xyz",
            "protocol": "TLS 1.3",
            "valid_to": "2026-12-26T19:58:43Z",
            "valid_from": "2026-09-27T19:58:44Z"
        },
        "domain_age_days": 1,
        "apex_age_days": 1,
        "tls_age_days": 1,
        "tls_valid_days": 89,
        "requests": 148,
        "verdicts": {
            "engines": {
                "tags": [
                    "urlscan-ml",
                    "urlscan-ml-60c5e22"
                ],
                "score": 98,
                "malicious": true
            },
            "overall": {
                "score": 0,
                "malicious": false
            }
        },
        "headers": {
            "server": "cloudflare",
            "content-type": "text/html"
        }
    },
    "cf": {
        "v": 1,
        "fetched_at": "2026-10-20T21:03:46Z",
        "uuid": "32a9cdb6-6fdb-4f8c-bc89-af36b2937dcd",
        "scanned_at": "2026-09-29T03:09:06Z",
        "final_url": "https://staking-zama.xyz/",
        "status": 200,
        "history": [
            {
                "url": "https://staking-zama.xyz/",
                "status": 200
            }
        ],
        "dom_hash": "df7dac5dd211e7923d5bc3882ad456f56e89ecaa8a1680df29ea759a6488b66b",
        "doc_hash": "00787777303c35f24cb8d86946522e96d858ff65e027c1958fbcb94a284e041b",
        "phishing_v2": [
            "phishing"
        ],
        "domain_risks": [
            "Newly Seen Domains",
            "Security Risks"
        ],
        "radar_rank": {
            "bucket": ">200000"
        },
        "dns": [
            {
                "name": "staking-zama.xyz",
                "type": "A",
                "value": "172.67.187.2"
            },
            {
                "name": "staking-zama.xyz",
                "type": "A",
                "value": "104.21.19.171"
            },
            {
                "name": "staking-zama.xyz",
                "type": "AAAA",
                "value": "2606:4700:3033::6815:13ab"
            },
            {
                "name": "staking-zama.xyz",
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:bb02"
            }
        ],
        "dnssec_valid": false,
        "ip": "172.67.187.2",
        "whois": {
            "registrar": "Eranet International Limited",
            "created": "2026-09-27T20:25:20Z",
            "updated": "2026-09-27T20:25:21Z",
            "expires": "2027-09-27T23:59:59Z",
            "nameservers": [
                "seamus.ns.cloudflare.com",
                "wanda.ns.cloudflare.com"
            ]
        }
    },
    "vt": {
        "v": 1,
        "fetched_at": "2026-10-21T16:44:01Z",
        "analysis_at": "2026-10-14T06:44:27Z",
        "stats": {
            "timeout": 0,
            "harmless": 53,
            "malicious": 2,
            "suspicious": 2,
            "undetected": 35
        },
        "detections": {
            "CRDF": "malicious",
            "SOCRadar": "suspicious",
            "alphaMountain.ai": "suspicious",
            "Forcepoint ThreatSeeker": "phishing"
        },
        "reputation": 0,
        "registrar": "ERANET INTERNATIONAL LIMITED",
        "created": "2026-09-28T04:25:20Z",
        "expires": "2027-09-27T23:59:59Z",
        "updated": "2026-09-28T00:00:00Z",
        "first_seen": "2026-09-27T22:35:31Z",
        "dns": [
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3033::6815:13ab"
            },
            {
                "ttl": 300,
                "type": "AAAA",
                "value": "2606:4700:3031::ac43:bb02"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "seamus.ns.cloudflare.com"
            },
            {
                "ttl": 1800,
                "type": "SOA",
                "rname": "dns.cloudflare.com",
                "value": "seamus.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "104.21.19.171"
            },
            {
                "ttl": 21600,
                "type": "NS",
                "value": "wanda.ns.cloudflare.com"
            },
            {
                "ttl": 300,
                "type": "A",
                "value": "172.67.187.2"
            }
        ],
        "dns_at": "2026-09-28T09:17:00Z",
        "jarm": "27d40d40d00040d1dc42d43d00041d6183ff1bfae51ebd88d70384363d525c",
        "cert": {
            "san": [
                "*.staking-zama.xyz",
                "staking-zama.xyz"
            ],
            "issuer": "Let's Encrypt / YE2",
            "serial": "57138b43ed95d0d8a1ab96af257d9505991",
            "sha256": "cf1a6840c6a9d491980272911282508a30efc669178b92abd24cd656df044f45",
            "subject": "staking-zama.xyz",
            "valid_to": "2026-12-26T19:58:43Z",
            "valid_from": "2026-09-27T19:58:44Z"
        },
        "whois": {
            "registrar": "ERANET INTERNATIONAL LIMITED",
            "registrar_iana_id": "1868",
            "registrar_url": "http://www.eranet.com",
            "created": "2026-09-27T20:25:20Z",
            "updated": "2026-09-27T20:25:21Z",
            "expires": "2027-09-27T00:00:00Z",
            "status": [
                "addPeriod",
                "clientTransferProhibited",
                "serverTransferProhibited"
            ],
            "nameservers": [
                "seamus.ns.cloudflare.com",
                "wanda.ns.cloudflare.com"
            ],
            "dnssec": "unsigned"
        }
    }
}
```