update-zama[.]info

Analysis of the domain update-zama.info, registered through NICENIC INTERNATIONAL GROUP CO., LIMITED, indicates active credential phishing infrastructure as of July 19, 2026. The domain resolves to IP address 104.21.0.127, hosted under Cloudflare, Inc. in Canada, and is served by Cloudflare nameservers peyton.ns.cloudflare.com and blakely.ns.cloudflare.com. The SSL certificate is issued by Google Trust Services (WE1), a common configuration for both legitimate and malicious sites leveraging Cloudflare’s proxy services. Infrastructure review reveals the domain appears on three security blocklists, including PhishDestroy, MetaMask, and SEAL, suggesting prior detection by multiple threat intelligence sources. Five of 91 security vendors on VirusTotal flag the domain as malicious, though the specific detection logic and targeted brand are not confirmed in available data. The domain remains operational, returning an HTTP 200 status, which may indicate ongoing phishing activity or a staged environment awaiting activation. Defenders should treat this domain as high-risk for credential theft. Network-level blocking is recommended, particularly in environments where user authentication occurs. Further investigation into associated email campaigns, redirect chains, or linked infrastructure may clarify the exact phishing kit or targeted service. No evidence confirms the specific brand being impersonated, and the domain’s content has not been analyzed for visual or functional indicators. Monitoring for changes in resolution, SSL certificate updates, or increased detection counts may provide additional context.