zamahub[.]xyz

Zamahub.xyz was registered through Global Domain Group LLC on 21 February 2026. The domain resolves to IP 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. in the United States and is served by Cloudflare nameservers alexandra.ns.cloudflare.com and matias.ns.cloudflare.com. The site presents an HTTPS certificate issued by Google Trust Services under the WE1 hierarchy, and HTTP responses return a 301 redirect. The page title observed is “Zama Auction Portal | Official ZAMA Token Claim & Auctions”, indicating an attempt to lure victims with a cryptocurrency‑related claim.

Technical fingerprinting shows the presence of AngularJS, HTTP/3, and HSTS, all typical of modern web applications but not indicative of malicious intent by themselves. Four independent security blocklists—PhishDestroy, MetaMask, ScamSniffer, and SEAL—have listed the domain, confirming a consensus among threat‑intel providers that the site is being used for phishing. VirusTotal analysis shows that 3 of 93 scanned security vendors flagged the domain, reinforcing the blocklist findings. No additional public intelligence, such as content screenshots or sandbox behavior, is currently available, so the full scope of the payload or credential‑harvesting mechanisms cannot be determined.

Given the registration date, hosting profile, and multiple blocklist entries, defenders should treat zamahub.xyz as a high‑risk phishing resource. Recommended mitigations include adding the domain to network‑level deny lists, configuring web‑proxy or DNS filtering to block resolution, and monitoring for any outbound connections to the associated Cloudflare IP. Continuous re‑assessment is advised, as the site remains active and may evolve its tactics.