zoom[.]capital

The domain zoom.capital was registered on May 27, 2026 through Porkbun LLC and is currently active. It resolves to the IPv4 address 76.223.54.146, which is associated with an AWS Global Accelerator endpoint located in the United States. The authoritative name servers listed for the zone are maceio.ns.porkbun.com, curitiba.ns.porkbun.com, and salvador.ns.porkbun.com, confirming the use of Porkbun’s DNS infrastructure.

Network analysis shows the host returns HTTP 200 responses and presents a TLS certificate issued by GoDaddy.com under the GoDaddy TLS Intermediate CA DV - R1v1 chain. The certificate is valid for the domain and does not exhibit any mismatches, suggesting the operator has obtained a legitimate certificate to increase credibility. The site’s low Gridinsoft trust score of 0/100 and its presence on three independent security blocklists indicate a high probability of malicious intent.

VirusTotal scans have flagged the domain by 2 of 95 security vendors, a modest detection rate, but the combined evidence from blocklist listings and the fact that it is actively blocked by PhishDestroy, MetaMask, and SEAL reinforces the classification as a high‑risk phishing resource. The threat type is recorded as generic_phishing, and the risk level is marked high, aligning with observed infrastructure characteristics.

Defenders should block DNS resolution for zoom.capital at perimeter devices and add the IP address 76.223.54.146 to network‑level deny lists. Email security gateways should be updated to quarantine messages containing URLs that resolve to this domain. Continuous monitoring of the associated AWS Accelerator endpoint is advised, as the operator may shift hosting or rotate IP addresses. Incident response teams should treat any credential submissions to this site as compromised and initiate appropriate user notification and remediation procedures.