zoomonline[.]co

This analysis concerns the domain zoomonline.co, which is actively impersonating the Shopify brand. The domain was registered on March 14 2026 through GoDaddy.com, LLC and is delegated to the authoritative name servers ns47.domaincontrol.com and ns48.domaincontrol.com. DNS resolution points to the IPv4 address 23.227.38.32, an address advertised by AS13335, a large content‑delivery network serving global traffic. The web service presents an HTTP 200 response and serves a page whose title tag reads "ZoomOnline". TLS is provided by a publicly trusted certificate authority, with the certificate issued under the identifier "E8". The site employs HSTS and HTTP/3, and its application stack includes Shopify‑derived components, indicating the use of a legitimate e‑commerce platform to lend credibility to the impersonation. Reputation metrics are uniformly negative: Gridinsoft assigns a trust score of 0 / 100, and the domain appears on three independent blocklists, including PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that 2 of 95 scanned security vendors flagged the domain as malicious. The overall risk rating is high and the campaign status remains active. Open questions remain about the extent of credential harvesting or additional payloads beyond the landing page, as no malware hashes have been publicly released. Defensive teams should therefore block all network resolution to zoomonline.co, add the domain to proxy and email filtering rules, and monitor for outbound connections to the associated CDN IP range. Continuous re‑evaluation is advised, given the rapid creation date and the likelihood of further infrastructure changes.