pre-zama[.]org

The domain pre-zama.org is assessed to have an elevated risk level due to its involvement in a credential theft phishing campaign. This domain poses a significant threat as it attempts to trick users into disclosing sensitive information such as login credentials and personal data.

Analysis indicates that pre-zama.org is flagged by 17 out of 95 security vendors on VirusTotal, suggesting a moderate level of detection across the industry. The domain is registered through NiceNIC International Group Co., Limited, and resolves to the IP address 172.67.136.245, which is located in the United States and is part of the AS13335 Cloudflare, Inc. network. The domain was created on November 15, 2025, and currently lacks an SSL certificate, further indicating its potential malicious nature. Additionally, pre-zama.org appears on two security blocklists, specifically PhishDestroy and ScamSniffer, which underscores the community's recognition of its threat.

To mitigate the risks associated with this credential theft campaign, users are advised to avoid clicking on any links or entering personal information on the site. Organizations should update their security policies to include this domain in their blocklists and educate employees about the signs of phishing attacks. Network administrators can also monitor for any attempts to access this domain and implement additional layers of authentication for any services that may be targeted by credential theft.