demo[.]zamma[.]xyz

demo.zamma.xyz was observed as an active phishing infrastructure targeting the cryptocurrency exchange Binance. The domain was registered on 2026-02-21 and is currently taken offline. DNS resolution points to 104.21.35.247, an address owned by Cloudflare, Inc. (AS13335) located in the United States. The site presented the page title “Portfolio update”, a common lure used in crypto‑related scams. The SSL certificate presented by the host is identified as “WE1”, indicating a valid TLS certificate issued for the domain, which may have been used to lend legitimacy. Reputation services have flagged the domain: two independent blocklists, PhishDestroy and ScamSniffer, have listed it, and it appears on two additional security blocklists.

VirusTotal analysis shows that 2 of 93 scanning engines returned a positive detection, reinforcing the malicious classification. Gridinsoft assigned a trust score of 0 out of 100, reflecting a lack of confidence in the site’s safety. The threat type is recorded as a crypto scam that impersonates Binance, aligning with the observed page title and brand target. The current status is offline, limiting immediate interaction but preserving forensic evidence. Analysis indicates that the infrastructure relies on Cloudflare’s anycast network, a common choice for threat actors seeking resilience and anonymity. The combination of a valid TLS certificate, a brand‑specific page title, and low trust scores suggests a deliberate attempt to deceive Binance users into revealing credentials or transferring assets.

Uncertainty remains regarding the exact phishing kit or additional payloads, as no further page content has been examined. Defenders should continue to block the domain at perimeter controls, monitor for any resurgence of the host name, and add the associated IP address to deny lists. Threat intelligence feeds should be updated to include the domain, its registration date, and the observed indicators.