zealearnings[.]app

Analysis of the domain zealearnings.app, created on July 21, 2026, shows that it is actively being used for phishing. The domain resolves to the IP address 188.114.96.3 and is served through Cloudflare name servers jade.ns.cloudflare.com and piotr.ns.cloudflare.com. Registration was performed by NICENIC INTERNATIONAL GROUP CO., LIMITED, indicating a commercial registrar but providing no further attribution. VirusTotal data records a single detection out of 91 security vendors, confirming that at least one scanning engine has identified malicious behavior.

The domain is listed on a public blocklist and is explicitly blocked by the PhishDestroy service, reinforcing the assessment of malicious intent. No additional public intelligence such as Safe Browsing, Open Threat Exchange, SSL/TLS certificate details, HTTP response codes, or page title information is currently available, leaving the exact content and lure technique unverified. Consequently, defenders should treat the domain as high‑risk and enforce immediate blocking at network perimeter, DNS, and endpoint layers.

Continuous monitoring of the IP address 188.114.96.3 for any changes in hosting or reputation is recommended, as is periodic re‑scanning with multi‑vendor services to capture any new detections. Organizations should also consider adding the domain to internal threat intelligence feeds and alerting security operations teams to any attempted connections from internal hosts. The lack of detailed page analysis means that future investigations should prioritize content retrieval to confirm the phishing vector and to support attribution efforts.