zumibi[.]com

This domain is flagged as an active credential harvesting phishing site targeting users of sports nutrition and healthy eating platforms. Analysis indicates the infrastructure is designed to deceive visitors into submitting login credentials, payment details, or personal information under the guise of a legitimate e-commerce service. The specific threat type—credential harvesting—is confirmed through behavioral patterns and infrastructure similarities to known phishing campaigns in the health and wellness sector. Infrastructure analysis reveals multiple high-risk indicators. The domain zumibi.com was registered on April 21, 2026, through Fewmoretaps OU d/b/a Trustname.com, a registrar frequently associated with low-reputation domains. It resolves to the IP address 188.114.97.3, which is hosted on a content delivery network known for anonymizing malicious traffic. Security vendors have flagged the domain in 6 out of 95 detection engines on VirusTotal, and it appears on at least one security blocklist. The trust score from Gridinsoft is 0/100, further confirming its malicious classification. Detected technologies include Google Analytics, Cloudflare Browser Insights, and Cloudflare’s HTTP/3 protocol, which are often exploited to evade detection and track victim interactions. Mitigation steps for this credential harvesting threat include immediate blocking of the domain and its associated IP address across all network security controls. Organizations should deploy endpoint protection rules to prevent access to the domain and monitor for any attempts to reach it. Users who may have interacted with the site should be instructed to reset credentials for any accounts entered on the platform, particularly those linked to financial or personal data. Security teams are advised to review logs for connections to 188.114.97.3 and correlate with any suspicious authentication attempts. Proactive measures such as phishing awareness training and multi-factor authentication enforcement are recommended to reduce the risk of successful credential theft from similar campaigns.