zan8vr6[.]sbs

Analysis of zan8vr6.sbs indicates that the domain is currently offline but was previously identified as part of a credential‑phishing campaign. The site was registered on March 19 2026 through Gname.com Pte. Ltd. and points to the Cloudflare‑managed address 104.21.30.75, which is associated with Cloudflare, Inc. in Canada. DNS resolution uses the Cloudflare nameservers sierra.ns.cloudflare.com and yadiel.ns.cloudflare.com, and the service was observed to support HTTP/3, yet no TLS certificate was presented at the time of capture, suggesting the site was serving content over plain HTTP or that the certificate was omitted from the scan data. Reputation data shows the domain appears on one security blocklist and has been blocked by the PhishDestroy service.

VirusTotal records indicate that 22 out of 94 scanning engines flagged the domain as malicious, reinforcing the suspicion of phishing activity. The page title returned by the remote host was “Telegram”, consistent with the reported scam type of credential phishing targeting Telegram users. The evidence does not reveal the exact content of the landing page, and no additional artifacts such as payload hashes or phishing kits have been disclosed.

Consequently, the full scope of the campaign, including victim targeting and infrastructure reuse, remains uncertain. Defenders should continue to block zan8vr6.sbs at perimeter filters, update URL‑filtering lists with the observed IP and domain, and monitor for any re‑appearance of the domain or related subdomains under the same registrar. Given the Cloudflare front‑end, future iterations may leverage new IPs, so threat‑intel feeds should be consulted regularly for fresh indicators.