zalandomall[.]com

On 24 July 2026 analysts reviewed the domain zalandomall.com, which was created on 5 March 2026 and registered through Gname.com Pte. Ltd. The domain resolves to the IP address 172.67.219.230, which belongs to AS13335, a Cloudflare network located in the United States. DNS resolution is served by the Cloudflare nameservers jakub.ns.cloudflare.com and vida.ns.cloudflare.com. The site employed a Cloudflare‑issued SSL certificate signed by Google Trust Services (WE1), indicating HTTPS encryption was in place while the domain was active. Front‑end technologies detected include Vue.js, HTTP/3 support, and HTTP Strict Transport Security (HSTS).

The only visible page title retrieved before the site was taken offline read "CMC后台管理系统," suggesting a Chinese‑language administrative interface but providing no further context about the targeted brand or phishing kit. The domain is currently listed as offline, yet it appears on three external security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis returned a single positive detection out of ninety‑five scanners, reinforcing the suspicion of malicious use.

While the exact content of the phishing page remains unknown, the combination of a recent registration, Cloudflare hosting, TLS certificate, and inclusion on multiple blocklists points to a short‑lived phishing operation. Defenders should continue to block zalandomall.com at DNS and proxy layers, add its IP address 172.67.219.230 to network deny lists, and monitor for any re‑registration or relocation of the domain. Ongoing threat‑intel feeds and periodic VirusTotal rescans are recommended to capture any future activity associated with this infrastructure.