z-cash[.]sbs

Analysis of the domain z-cash.sbs indicates an active high-risk phishing campaign targeting cryptocurrency users. Registered on May 18, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, the domain currently resolves to the IP address 188.114.96.3, hosted behind Cloudflare infrastructure in Canada. The nameservers, june.ns.cloudflare.com and nikon.ns.cloudflare.com, further confirm Cloudflare as the DNS provider. As of July 12, 2026, the domain remains active, returning an HTTP 403 status with the page title 'Just a moment...', a common response from Cloudflare when access is restricted or under review. Security vendor detection remains limited but notable: two of ninety-two engines on VirusTotal flagged the domain as malicious. The domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, and is referenced in one AlienVault OTX threat intelligence pulse. Gridinsoft assigns a trust score of 0/100, reinforcing its classification as high-risk. The SSL certificate is issued by Let’s Encrypt, a common choice among both legitimate and malicious sites, offering no definitive indication of intent. Infrastructure analysis reveals no confirmed brand impersonation or specific phishing kit association. The domain name, z-cash.sbs, suggests a potential focus on cryptocurrency, possibly referencing privacy-focused digital assets, though no direct evidence of a specific target (e.g., Zcash or other platforms) is present in available data. The exact nature of the phishing mechanism—whether credential harvesting, wallet drainer, or fraudulent token distribution—remains unconfirmed due to the lack of accessible page content. Defenders are advised to block the domain at the DNS or network level, particularly in environments handling cryptocurrency transactions. Monitoring for connections to 188.114.96.3 and associated Cloudflare IP ranges may aid in detecting compromised endpoints.