coinzooma[.]com

PhishDestroy first observed coinzooma.com on Feb 16, 2026. The hostname explicitly references Zoom; stored content metadata identifies the same apparent target. The captured page title is “Coin Zooma”. Stored page analysis classifies the content as brand impersonation. Current evidence score: 73/100 (critical).

Positive findings are stored from 3 sources: VirusTotal, CryptoFirewall, and DNS security resolvers. VirusTotal recorded 2 detections among 93 engines: alphaMountain.ai, SOCRadar on Jul 10, 2026 at 14:59 UTC. CryptoFirewall listed the hostname in the external-blocklist snapshot on Aug 7, 2026 at 22:20 UTC. DNS security checks returned 1 blocking result across 14 tested policies: Brand Zoom; no observation timestamp was retained. Non-positive and contextual checks: ScamAdviser assigned a trust score of 6/100 (Very Likely Unsafe); no observation timestamp was retained. AlienVault OTX listed 1 community pulse reference (not vendor detections) on Mar 1, 2026 at 08:14 UTC. URLQuery recorded no positive detection on Feb 16, 2026 at 13:48 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:34 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 02:53 UTC.

HTTP 301 was recorded on Aug 7, 2026 at 22:14 UTC. Registration records for the domain list GoDaddy.com, LLC as the registrar. At collection time, the hostname resolved to 5.100.156.25 on AS2635 (Automattic, Inc). The recorded endpoint location is Istanbul, TR. The stored server header is nginx. DOM analysis on Jul 9, 2026 at 02:22 UTC returned 0/100; the source detections above were recorded separately. The evidence archive retains 3 visual captures from PhishDestroy, URLScan, and URLQuery. TLS metadata lists E7 as the certificate issuer with validity through May 27, 2026; checked Mar 15, 2026 at 05:54 UTC.

The content indicators and 3 positive source findings support the current Zoom-themed brand impersonation classification.