zefixglobalholdingltd[.]com[.]mainlinesecuritiesltd[.]com

Analysis of the domain zefixglobalholdingltd.com.mainlinesecuritiesltd.com indicates an active high‑risk generic phishing operation. The site was registered on March 11, 2026 through Ultahost, Inc. and resolves to IP 192.142.10.5, which is geolocated to the Netherlands and associated with ASN214036 (Ultahost, Inc.). The host presents a valid Let's Encrypt certificate (YE2) and returns HTTP 200, suggesting the infrastructure is fully operational. Technical fingerprinting reveals a WordPress stack backed by MySQL, PHP, Bootstrap, LiteSpeed, and front‑end components such as Slider Revolution, Smartsupp, and Twitter widgets. The domain appears on one security blocklist and is actively blocked by PhishDestroy. VirusTotal scans show three of ninety‑five vendors flagging the domain, and Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment. Nameservers ns1‑ns4.ultahost.com are consistent with the registrar’s hosting environment. While the page title is merely "HOME" and no further content has been disclosed, the combination of recent registration, active hosting, low trust rating, and multiple security detections supports a high confidence classification as a generic phishing site. Defenders should immediately block the domain and its associated IP, monitor for related subdomains or infrastructure reuse, and consider sinkholing traffic for forensic analysis. Ongoing observation is advised to detect any evolution of the campaign or emergence of additional indicators.