zannattex[.]com

Analysis of the domain zannattex.com indicates that it was used as an account‑takeover phishing vector before being taken offline. The domain was registered on February 21, 2026 and resolves to the IPv4 address 103.213.38.36, which is hosted in Bangladesh under AS150142 Wolast Technologies. The site presented the page title “Account Suspended,” suggesting that the hosting provider or the operator deliberately disabled the front‑end content prior to takedown. SSL inspection shows the site used an R13 certificate, a low‑grade certificate that provides minimal validation and is typical of malicious infrastructure.

Threat intelligence sources corroborate the malicious nature: AlienVault OTX recorded the domain in two separate pulses, and it appears on one public security blocklist. The anti‑phishing service PhishDestroy also lists the domain as blocked. VirusTotal scans returned detections from 13 of 93 security vendors, reinforcing the presence of malicious payloads or indicators.

Current status is offline, but the underlying IP and hosting provider remain active and could be reused for future campaigns. Defenders should add both the domain and the associated IP address to deny lists, monitor for any re‑registration or new services originating from the same ASN, and consider updating URL filtering policies to include the observed page title. Continuous observation of related blocklists and OTX feeds is recommended to capture any resurgence of the infrastructure.