zamaupdate[.]live

Analysis of zamaupdate.live indicates an active credential‑phishing operation. The domain was registered on February 21, 2026 through NiceNIC International Group Co., Limited and currently resolves to IP address 104.21.8.87, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. The site presents a HTTP 301 redirect and serves content over TLS with a certificate issued by Google Trust Services under the WE1 intermediate, confirming legitimate‑looking encryption.

Infrastructure fingerprints show the use of Cloudflare’s edge network, HSTS enforcement, HTTP/3 support, and third‑party assets from jsDelivr, all of which are common in malicious hosting to provide resilience and hide origin. Reputation data is strongly negative: VirusTotal records 10 detections out of 95 scanned vendors, three independent blocklists list the domain, and the Gridinsoft trust score is 0 / 100. The page title returned by the server is "Zama - Open Source Cryptography," which does not match any known legitimate service and suggests an attempt to masquerade as a cryptography resource to lure credentials.

The domain is actively blocked by PhishDestroy, MetaMask, and SEAL, confirming that multiple anti‑phishing platforms have identified it as malicious. Defenders should immediately add zamaupdate.live to URL filtering and DNS blocklists, monitor outbound traffic for connections to the Cloudflare IP range associated with this host, and consider sinkholing or redirecting requests to a safe landing page. Continuous scanning of the domain for changes in page content or additional infrastructure deployment is advised, as the current evidence points to a high‑risk credential‑phishing campaign that remains operational.