zapbit[.]io

zapbit.io is a newly registered domain (created 2026-03-03) that has been observed serving a page titled “Buy & Sell Bitcoin, Ethereum | Cryptocurrency Exchange | ZapBit”. The title explicitly references Ethereum, indicating a brand-impersonation attempt aimed at cryptocurrency users. The domain resolves to 172.67.222.254, an IP address owned by AS13335 Cloudflare, Inc. and located in the United States. DNS resolution is delegated to ganz.ns.cloudflare.com and hera.ns.cloudflare.com, both Cloudflare name servers, implying that the operator is leveraging Cloudflare’s CDN and protection services. No SSL certificate is presented; the site served HTTP only, which is unusual for a site claiming to handle financial transactions and reduces trust for legitimate users. Reputation checks show a Gridinsoft trust score of 0/100, and the domain appears on one security blocklist, currently blocked by PhishDestroy.

VirusTotal analysis recorded 7 detections out of 94 scanning vendors, further confirming malicious intent. The registrar listed is NiceNIC International Group Co., Limited, a registrar frequently associated with short-lived, high-risk domains. The site’s current HTTP status is “taken offline”, so active content cannot be verified, but the combination of a brand-targeted title, low trust scores, and multiple vendor detections strongly suggests a crypto-focused scam. The known scam type is “Crypto Scam”, though the specific technique (e.g., phishing, credential harvesting, or fund diversion) has not been disclosed. Defenders should treat zapbit.io as hostile.

Immediate actions include adding the domain and its IP address to network blocklists, updating DNS sinkhole configurations, and ensuring that endpoint protection solutions subscribe to the latest threat feeds that contain this indicator. Monitoring for future registrations that reuse the same registrar, name-server pattern, or similar page‑title phrasing can help detect early-stage campaigns.