zenchain-quest[.]com

Analysis of zenchain-quest.com indicates that the domain is currently offline but was previously identified as a phishing vector. The site presented the page title "ZenPass," suggesting an attempt to lure credentials related to a password management or authentication service. The domain was registered on January 12, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and resolves to the IP address 172.67.220.251, which belongs to Cloudflare, Inc. (AS13335) and is geolocated in the United States. The SSL certificate associated with the domain is listed as WE1, confirming that HTTPS was in use at the time of detection.

Infrastructure analysis shows a Gridinsoft trust score of 0 out of 100, indicating a complete lack of trust from that vendor. The domain appears on five independent security blocklists and has been flagged by multiple detection services, including PhishDestroy, ScamSniffer, Polkadot, Enkrypt, and Codeesura. VirusTotal scans reported six positive detections out of ninety‑three scanners, reinforcing the malicious classification.

While the exact phishing kit or targeted brand is not disclosed in the available intelligence, the combination of a deceptive page title, low trust score, and multiple blocklist listings provides strong evidence of a phishing campaign. Defenders should continue to block the domain at network perimeters, update URL filtering rules to include the observed IP and hostname, and monitor for any re‑hosting attempts that may arise from the same registrar or IP range. Ongoing vigilance is recommended, as the offline status does not preclude future re‑activation.