zapware[.]xyz

This domain, zapware.xyz, is flagged as a high-risk credential harvesting phishing site targeting users under the guise of a software development studio. Analysis indicates the domain is actively masquerading as a legitimate software provider, using the page title 'Zapware — Software studio. We build useful apps, properly.' to deceive visitors into submitting sensitive login credentials or downloading malicious payloads. Infrastructure analysis reveals the domain was registered on June 28, 2026, through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar frequently associated with abusive domains. It resolves to the IP address 188.114.96.3, which has been linked to prior phishing campaigns. Detection engines on VirusTotal flag the domain as malicious, with 2 out of 95 security vendors identifying it as a threat. The domain is also listed in one AlienVault OTX threat intelligence pulse, further corroborating its malicious nature. The SSL certificate is issued by Google Trust Services, a tactic commonly employed by threat actors to lend false legitimacy to phishing pages. Mitigation steps for this specific threat type include immediate blocking of the domain and its resolving IP (188.114.96.3) at the network perimeter. Organizations should deploy email and web filtering rules to prevent users from accessing zapware.xyz or any subdomains. Endpoint protection solutions should be updated to detect and quarantine any artifacts associated with this campaign. User awareness training should emphasize the risks of credential harvesting attacks, particularly those impersonating software providers. Security teams are advised to monitor for indicators of compromise, including unusual authentication attempts or outbound connections to the identified IP address.