zsmartappkey[.]live

This domain is flagged as a high-risk generic phishing threat targeting users through a fraudulent document portal interface. Analysis indicates the site is designed to harvest credentials or distribute malicious payloads under the guise of legitimate document access, as evidenced by its deceptive page title 'Document' and minimal detection on security platforms. Infrastructure analysis reveals the domain was registered on June 24, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with malicious domains. It currently resolves to IP address 188.114.96.3, which has been linked to other phishing campaigns. The SSL certificate is issued by Google Trust Services, providing a false sense of security. VirusTotal reports only 1 out of 95 security vendors flagging this domain as malicious, suggesting either recent deployment or evasion techniques to avoid detection. No known blocklist entries or trust score improvements were identified at the time of analysis. Mitigation requires immediate blocking of the domain and its resolving IP (188.114.96.3) at network perimeter devices. Organizations should monitor for connections to this IP and domain, particularly from endpoints accessing document-sharing services. End-user education should emphasize verifying SSL certificates and domain legitimacy before entering credentials. Security teams are advised to inspect logs for HTTP/HTTPS traffic to zsmartappkey.live and correlate with authentication attempts or unusual file downloads. If credentials were exposed, reset passwords and enable multi-factor authentication on affected accounts. Consider implementing DNS-based filtering to prevent resolution of newly registered domains from high-risk registrars.