regestration-zama[.]org

This domain, regestration-zama.org, is currently flagged as an active cryptocurrency wallet phishing site targeting users through deceptive credential harvesting tactics. The page title "רק רגע..." (Hebrew for "Just a moment...") suggests a localized attack vector, likely impersonating legitimate wallet verification or recovery processes to steal private keys or seed phrases. The domain remains operational and poses a high-risk threat to individuals interacting with blockchain-based financial services. Analysis indicates the domain was registered on February 21, 2026, through Global Domain Group LLC, an uncommon registrar for legitimate cryptocurrency services. Infrastructure analysis reveals resolution to IP address 188.114.96.3, hosted on AS13335 (Cloudflare, Inc.), a network frequently leveraged to obscure malicious infrastructure. Detection metrics show 12 of 95 security vendors on VirusTotal have flagged the domain as malicious, while it appears on three distinct security blocklists. The SSL certificate, issued by Google Trust Services (WE1), provides minimal legitimacy but does not mitigate the underlying threat. The domain's creation date, set in the future (2026), further suggests an attempt to evade reputation-based detection systems. Current status confirms the domain remains active and continues to host phishing content. Users are strongly advised to avoid interaction with regestration-zama.org and any associated links. Organizations should implement DNS-based blocking for the domain and its resolving IP (188.114.96.3) at the network perimeter. Cryptocurrency wallet providers are recommended to monitor for credential reuse attempts originating from this infrastructure. Given the localized targeting implied by the Hebrew page title, regional security teams should prioritize awareness campaigns to mitigate potential victimization.