zenithloops[.]ltd

The domain zenithloops.ltd was created on 24 February 2026 and is currently registered with OwnRegistrar, Inc. It is hosted on the IP address 45.88.191.202 and uses the authoritative name servers ns3.ultraprohost.com and ns4.ultraprohost.com. The domain is listed on two public security blocklists and is actively blocked by the PhishDestroy and SEAL filtering services, indicating that it is already being treated as malicious by multiple anti‑phishing platforms. VirusTotal analysis shows that two of ninety‑one scanned security vendors have flagged the host, further confirming the presence of suspicious activity. The overall risk rating assigned to the domain is high and its operational status remains active.

Infrastructure analysis reveals no additional evidence of legitimate services; the IP address is not associated with any known corporate or public‑facing web infrastructure, and the name servers belong to the generic hosting provider Ultraprohost, a common choice for disposable or short‑lived malicious sites. No SSL certificate details, HTTP response codes, or page title information have been published, so the content of the site cannot be confirmed at this time. The lack of visible legitimate traffic combined with blocklist inclusion and vendor detections strongly suggests that the domain is being used for a generic phishing campaign, likely to harvest credentials or deliver malicious payloads. Defenders should immediately block DNS resolution and web traffic to zenithloops.ltd at perimeter firewalls and proxy devices.

Continuous monitoring of DNS queries for the domain and its associated name servers is advised, as well as periodic rescanning with VirusTotal or equivalent sandbox services to detect any changes in payload behavior. Sharing the indicator set—including the domain name, IP address, and name server records—with internal threat‑intel platforms and external information‑sharing communities will help accelerate detection of related campaigns.