z-e-r-o-l-e-n-d[.]net

PhishDestroy identifies z-e-r-o-l-e-n-d.net as an active generic phishing domain registered on 20 June 2025 that poses a high immediate risk to credential confidentiality. The threat actor’s goal is the systematic exfiltration of user login credentials via spoofed landing pages that mimic legitimate services. Based on verified threat intelligence, z-e-r-o-l-e-n-d.net currently shows 0 detections out of 95 engines on VirusTotal, indicating zero antivirus coverage as of seed 49171a. The domain resolves to IP address 172.67.199.197 using an SSL certificate issued by Google Trust Services, which falsely elevates perceived trust. Domain registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, and the site became accessible on 20 June 2025. Despite the absence of blocklist entries, the combination of fresh registration, active infrastructure, and counterfeit SSL trustworthiness creates a credible lure mechanism primed for credential harvesting. To mitigate exposure, users should immediately block or flag z-e-r-o-l-e-n-d.net at network and endpoint levels; verify HTTPS certificate issuer and domain age before entering credentials; and report the domain to threat intelligence platforms to increase detection coverage. Organizations should deploy DNS sinkholes and web-proxy rules referencing the IP 172.67.199.197 to prevent outbound callbacks. Continuous monitoring for credential leaks on this domain is advised until detection rates improve.