get-zet[.]org

The domain get-zet.org was observed on July 12, 2026 delivering a generic phishing campaign targeting users of cryptocurrency platforms. The site presents a page titled “Zetarium $ZET” and returns HTTP 200, indicating an active web service. Infrastructure analysis shows the domain resolves to 172.67.204.169, an address allocated to AS13335, a large content‑delivery network operating in the United States. The domain uses a TLS certificate issued by a widely trusted certificate authority (Google Trust Services / WE1) and is served over HTTP/3. DNS records are delegated to two name servers identified as karl.ns and sofia.ns, both belonging to the same CDN provider. The site incorporates third‑party libraries from jsDelivr and is protected by the provider’s edge security services. Threat intelligence indicates the domain appears on four independent blocklists and has been flagged by at least two security vendors on VirusTotal, with a 2/95 detection ratio. The overall trust score from a commercial scanner is 0/100, reinforcing the malicious classification. While the hosting environment obscures the ultimate operator, the combination of a newly created domain (registered February 21 2026), high‑risk rating, and active status suggests a deliberate attempt to harvest credentials. No additional payloads or command‑and‑control infrastructure have been observed, leaving the full attack chain uncertain. Defenders should block network connections to 172.67.204.169 and add get-zet.org to URL filtering and email security policies. Monitoring for DNS queries to the domain’s name servers can provide early warning of infection attempts. Because the site leverages a reputable CDN, traditional reputation‑based blocks may be delayed; therefore, real‑time threat intelligence feeds should be consulted to ensure rapid inclusion of this indicator. Incident response teams should treat any credential submissions to the site as compromised and enforce credential rotation.