claim[.]zoraa[.]name

This domain, claim.zoraa.name, is currently classified as a high‑risk brand‑impersonation campaign targeting the Zora brand. The domain was registered on August 05 2025 through PDR Ltd. d/b/a PublicDomainRegistry.com and remains active as of the 12 July 2026 reporting date. Detection feeds list the domain as blocked by PhishDestroy, and it appears on one public security blocklist. Infrastructure analysis reveals that the domain resolves to the IP address 104.21.16.154, which is owned by AS13335 Cloudflare, Inc. and geolocated in the United States. Authoritative name servers are earl.ns.cloudflare.com and melody.ns.cloudflare.com, both operated by Cloudflare. Observed technologies include Cloudflare Browser Insights, Cloudflare edge services, and HTTP/3 support, indicating that the attacker is leveraging a modern CDN platform for rapid content delivery and potential evasion. The web server returns an HTTP 403 status code and presents the page title “Just a moment…”. The TLS certificate is issued by Google Trust Services under the WE1 designation, confirming a valid certificate chain despite the malicious intent. The site is tagged as a cryptocurrency‑related scam, and one of ninety‑five VirusTotal scanners flagged the domain, providing a 1/95 detection ratio. The combination of brand impersonation, a cryptocurrency lure, and the presence on a blocklist reinforces the high‑risk assessment. Defenders should immediately add claim.zoraa.name to network‑level deny lists and configure DNS filtering to block resolution. Continuous monitoring of Cloudflare‑associated IP ranges for new subdomains that reference the Zora brand is advised, as the attacker may rotate hosts within the same CDN. Security teams should also update email and web gateway signatures to capture the “Just a moment…” title pattern and consider threat‑intel sharing with peers to broaden early warning capabilities.