web04zoom[.]im

PhishDestroy first observed web04zoom.im on Feb 26, 2026. Current evidence score: 95/100 (critical).

Positive findings are stored from 4 sources: VirusTotal, Spamhaus DBL, DNS security resolvers, and URLQuery. VirusTotal recorded 19 detections among 93 engines: ADMINUSLabs, alphaMountain.ai, BitDefender, Certego, CRDF, CyRadar, ESET, Forcepoint ThreatSeeker, Fortinet, G-Data, Gridinsoft, Lionic, PhishFort, Seclookup, SOCRadar, Sophos, Trustwave, VIPRE, Webroot on Feb 25, 2026 at 01:17 UTC. Spamhaus DBL: DBL_MALWARE on Jul 14, 2026 at 02:38 UTC. DNS security checks returned 11 blocking results across 14 tested policies: Adguard Default, Adguard Family, Brand Zoom, Cloudflare Family, Cloudflare Security, Control D Adblock, Control D Family, Control D Malware, Mullvad Adblock, Opendns Standard, Quad9 Secure; no observation timestamp was retained. URLQuery recorded 2 threat-system alerts on Jan 13, 2026 at 05:19 UTC. Non-positive and contextual checks: AlienVault OTX listed 1 community pulse reference (not vendor detections) on Mar 1, 2026 at 03:00 UTC. The separate external-blocklist snapshot contained no matches on Aug 8, 2026 at 02:20 UTC. Google Safe Browsing returned no flag on Mar 2, 2026 at 20:48 UTC. URLScan completed without a malicious verdict (score 0) on Jul 29, 2026 at 03:18 UTC. PhishStats returned no feed match on Mar 1, 2026 at 09:04 UTC.

HTTP 502 was recorded on Aug 7, 2026 at 01:28 UTC; content was unavailable. Registration records for the domain list Redacted as the registrar and Feb 21, 2026 as the creation date. Registration preceded first observation by 5 days. At collection time, the hostname resolved to 89.163.155.33 on AS24961 (WIIT AG). The recorded endpoint location is Frankfurt am Main, DE. DOM analysis on Jul 29, 2026 at 04:11 UTC returned 85/100. The evidence archive retains 2 visual captures from PhishDestroy and URLQuery; no page title was retained, so the captures preserve the landing-page appearance.

The record contains 4 positive source findings supporting the current phishing classification. The stored fields do not identify an impersonated brand or victim interaction.