zoom3[.]xyz

The domain zoom3.xyz has been identified as a brand_impersonation threat targeting Apple users. Currently offline, this infrastructure was designed to mimic Apple services, likely to harvest credentials or payment details. Analysis indicates the domain was registered to deceive users into believing they were interacting with legitimate Apple iCloud or related authentication portals. Infrastructure analysis reveals the following technical indicators: the domain resolves to IP address 162.159.140.229 and was registered through NameCheap, Inc. on December 23, 2025. Despite its recent creation, it appears on three security blocklists, including MetaMask, SEAL, and PhishDestroy. The domain received a Gridinsoft trust score of 0/100, and VirusTotal recorded 0 detections out of 95 vendors, suggesting evasion of initial automated detection. Detected technologies include Apple iCloud Mail, Node.js, Salesforce, Google Sign-in, Amazon Web Services, Stripe, Express, and HSTS, alongside a Google Trust Services SSL certificate. The page title, "Funny Or Die on X: 'Billy Eichner knows all about the life of a showgirl 🧡 #taylorswift #ts12," appears unrelated to the phishing content, potentially indicating cloaking or misdirection techniques. Current status confirms the domain has been taken offline, though its infrastructure may resurface under a different name or IP. Organizations and users are advised to block the domain and associated IP at the network level. Security teams should monitor for similar patterns, including domains registered through NameCheap with recent creation dates, AWS-hosted infrastructure, and Apple-related branding. End users should verify the legitimacy of any Apple authentication or payment pages by cross-referencing URLs with official Apple domains and enabling multi-factor authentication to mitigate credential theft risks.