Zulrah has a Defence, Magic and Ranged level of 300, plus a small accuracy and strength bonus on every form. It has no melee defence on any form, but it swims in the water around the U-shaped island and can only be reached by a halberd-type weapon – everything else has to be Ranged or Magic. It attacks at speed 3, and is aggressive and poisonous (venom).
One quirk that catches everyone out: damage to Zulrah is capped at 50. Any hit that would deal more than 50 is randomly reduced to between 45 and 50 instead. (The Twisted bow is still worth using, because dealing over 50 more often means more hits land in that 45–50 band.) Another: damage is calculated when an attack is generated, not when the projectile lands. That means if Zulrah dies just as it launches an attack, that attack can still deal damage and even kill you – keep your health and the correct overhead prayer up until the loot actually drops.
Green (serpentine) form – Ranged attacker, weak to Magic
When Zulrah is green it attacks with Ranged. Pray Protect from Missiles. It is weak to Magic in this form – it has −45 magic defence and +50 ranged defence, so this is where your magic switch does the most work. Its max hit is 41.
Tanzanite (blue) form – Magic + Ranged attacker, weak to Ranged
The tanzanite form (the main page calls it "blue") randomly attacks with both Magic and Ranged, but uses Magic much more frequently, so the recommended overhead is Protect from Magic. It is weak to Ranged in this form – +300 magic defence and +0 ranged defence – so range it down. Its max hit is 41. Note Zulrah can fire Ranged up to five times in succession here.
Crimson (magma/red) form – typeless melee swipe, weak to Magic
When Zulrah is red it uses a typeless attack: it stares at the player's position for several seconds, then whips its tail at that spot. Avoid it by moving two tiles away from the targeted area before it strikes. If it connects you take 20–30 damage and are stunned for several seconds – there is no overhead prayer that blocks it, only movement. This form is more resistant to damage than the other two (+300 ranged defence, +0 magic defence), so Magic is typically more effective than Ranged here. Its max hit is 30.
Snakelings
In any form, Zulrah can summon snakelings by shooting white orbs. Each snakeling attacks with either magic or melee (never both). They are combat level 90 but have only 1 Hitpoint, so they die in one hit – the catch is they are extremely accurate and can hit up to 15. Protection prayers block their attacks, but if Zulrah is also attacking it is usually better to tank the snakelings and pray against Zulrah, since it hits harder. This is why a Ring of recoil or Ring of suffering is so strongly recommended: it kills snakelings for you. If Zulrah throws a white orb just before diving, the snakeling only appears after Zulrah resurfaces. Snakelings die off on their own after lingering more than 40 seconds, and all die when Zulrah is killed.
Venom clouds
Zulrah also spawns venom clouds via a barrage of dark-green orbs. Standing in a cloud's 3x3 area deals damage every tick, which adds up fast, so position yourself out of them each phase. Sometimes a phase forces you to run through a cloud to re-position – take the cloud damage rather than eat a full unprepared Zulrah attack. Importantly, venom clouds deal venom damage but do not envenom you, unlike Zulrah's and the snakelings' direct attacks, which envenom even through a protection prayer unless they miss.