zs1937[.]com

Analysis indicates that the domain zs1937.com is currently flagged as a generic phishing site. The domain was registered through Dynadot LLC on 1 April 2025 and is hosted on the IP address 194.102.104.245, which belongs to AS48753 (AVA HOST SRL) located in Maryland, United States. The authoritative name servers are aitana.ns.cloudflare.com and lennox.ns.cloudflare.com, both belonging to Cloudflare’s DNS service. No TLS certificate is presented, meaning the site is served over plain HTTP only. An HTTP request returns a page with the title “zs1937.com — Coming Soon”, suggesting that the site is either a placeholder or intentionally minimal, but no further content has been observed because the service is presently offline.

VirusTotal reports that 16 of 95 scanned security vendors have flagged the domain, providing independent confirmation of malicious intent. AlienVault OTX lists the domain in four separate threat‑intel pulses, and it is present on one public blocklist. PhishDestroy also lists zs1937.com as a blocked resource. These multiple detections across independent platforms increase confidence that the domain is being used for phishing or related abuse. Because the site is offline, direct payload inspection is not possible, and the exact phishing campaign details (targeted brand, credential‑stealing page structure, or malicious payload) remain unknown.

Nevertheless, the convergence of detection signals, the lack of encryption, and the recent creation date support a high likelihood of abuse. Defenders should continue to block traffic to zs1937.com at network perimeters, update DNS sinkhole entries, and ensure that security solutions reference the current blocklist identifiers. Monitoring of the hosting IP 194.102.104.245 for any re‑activation or related sub‑domains is recommended, as is periodic re‑scanning of the domain once it becomes reachable again. Organizations using URL filtering or web‑proxy services should add zs1937.