sale-zama[.]xyz

Analysis of sale-zama.xyz indicates a confirmed phishing domain leveraging Cloudflare infrastructure, currently offline but previously flagged by multiple security vendors. The domain was registered on March 11, 2026, through PDR Ltd. d/b/a PublicDomainRegistry.com and resolves to 188.114.97.3, an IP address under AS13335 (Cloudflare, Inc.) located in the US. Nameservers frida.ns.cloudflare.com and venkat.ns.cloudflare.com further confirm Cloudflare hosting, while the SSL certificate is issued by Let's Encrypt (E7), a common choice for both legitimate and malicious sites. The HTTP status returned is 403, and the page title explicitly states 'Suspected phishing site | Cloudflare,' suggesting Cloudflare's own detection mechanisms may have intervened.

Detection data is limited but notable: one security vendor on VirusTotal flags the domain, and it appears on four security blocklists, including PhishDestroy, MetaMask, ScamSniffer, and SEAL. The exact phishing target or scam type remains unconfirmed, as no brand or specific threat category is identified in the available evidence. Technologies detected include Cloudflare and HTTP/3, which are neutral but consistent with modern phishing campaigns seeking to evade detection via reputable CDN services. Defenders should treat this domain as high-risk despite its current offline status.

The combination of Cloudflare hosting, Let's Encrypt SSL, and multiple blocklist appearances aligns with known phishing infrastructure patterns. While the domain may reappear under altered hosting or DNS configurations, its registration details and historical detections provide sufficient grounds for proactive blocking. No evidence suggests this is part of a broader campaign, but monitoring for related domains using the same registrar or IP range is recommended. If the domain resurfaces, defenders should prioritize full forensic capture of the site content to determine the exact phishing mechanism and target.