zona593[.]live

The domain zona593.live is a confirmed phishing site engaged in brand impersonation, specifically targeting Google. It presents itself as a legitimate Google page to deceive users into disclosing sensitive information, posing an elevated risk of credential theft. No crypto drainer kit was identified. As of the latest verification, zona593.live has been taken offline.

Technical indicators confirm the malicious nature of zona593.live. The domain was flagged by 1 of 95 VirusTotal security vendors, including SOCRadar, and appears on 1 security blocklist (PhishDestroy). It was registered through NameCheap, Inc. on January 16, 2023, and resolves to the IP address 142.250.185.196, hosted by Google LLC (AS15169) in the US. The site lacks an SSL certificate, and its nameservers are guy.ns.cloudflare.com and veda.ns.cloudflare.com. The observed page title was 'Google', reinforcing its impersonation attempt.

Users who interacted with zona593.live should immediately change any passwords entered on the site, enable two-factor authentication (2FA) on their Google account, and monitor for unauthorized access or fraudulent activity. Report the domain to Google’s phishing reporting tool and to platforms like PhishTank or the Anti-Phishing Working Group (APWG) to aid in broader mitigation efforts. If financial or crypto accounts were accessed, revoke any active token approvals and consider transferring funds to a new, secure wallet.