# PhishDestroy threat dossier — zoomtick.com ================================================================ Fetched: 2026-04-24 11:15:29 UTC Canonical: https://phishdestroy.io/domain/zoomtick.com/ ## VERDICT ---------------------------------------------------------------- STATUS STALE — last probed 24 days ago, treat as ACTIVE until re-verified Composite threat score: 64/100 (PhishDestroy scoring — see methodology below) ## DETECTION EVIDENCE ---------------------------------------------------------------- VirusTotal: 4/93 security vendors flagged this domain Flagging vendors: alphaMountain.ai, Gridinsoft, Seclookup, SOCRadar URLQuery: 2 detections Public blocklists: listed on 3 independent blocklists Victim re-reports (public form): 1 ## INFRASTRUCTURE ---------------------------------------------------------------- IP address: 144.91.101.115 (FR, Lauterbourg) ASN: ASAS51167 Contabo GmbH Hosting org: AS51167 Contabo GmbH Registrar: NameCheap, Inc. Nameservers: ["aitana.ns.cloudflare.com", "vern.ns.cloudflare.com"] Registered: 2026-02-21 Page title: Sorry, the website has been stopped ## TLS CERTIFICATE ---------------------------------------------------------------- Issuer: Google Trust Services / WE1 Expires: 2026-05-04 Status: INVALID chain Fingerprint: d02ec21d4be9f0abd8335f3f652e41894b633b5033da6bceeb220e9ffa173ee2 ## ABUSE-REPORT HISTORY (evidence of registrar non-response) ---------------------------------------------------------------- Status: pending notification queue. No abuse reports filed yet — this domain is waiting for the next cycle of our automated abuse-reporter. ## TIMELINE ---------------------------------------------------------------- Domain registered: 2026-02-21 (per WHOIS / CT — may reflect a renewal or transfer date, not first-ever registration) First detected: 2026-02-25 02:39:27 UTC (by PhishDestroy tracker) Earliest abuse rec: 2026-02-02 17:03:03 UTC — PREDATES current WHOIS registration; retained from a previous registration cycle of the same domain name Last verified: 2026-03-31 01:18:37 UTC (STALE — 24 days ago, re-verify) Flagged dead: 2026-03-16 12:04:47 UTC (NOT RE-VERIFIED IN 24 DAYS — treat as unconfirmed) Current status: UNCONFIRMED (our live-probe is 24 days stale) Note: one or more events above predate the WHOIS creation date. This typically means the same domain name was previously registered, detected, dropped, and then re-registered by a new party. PhishDestroy preserves the full historical record for operator-attribution research even when the underlying infrastructure changes hands. ## EXTERNAL CORROBORATION (third-party evidence) ---------------------------------------------------------------- URLScan.io: https://urlscan.io/result/019c1e4d-b7cb-766b-9319-11271999e5ac/ URLQuery: https://urlquery.net/report/b7d0d6a1-9eb8-4d7d-84f1-371892b9648d Wayback Machine: https://web.archive.org/web/*/zoomtick.com crt.sh CT logs: https://crt.sh/?q=%25.zoomtick.com Google transparency: https://transparencyreport.google.com/safe-browsing/search?url=zoomtick.com AlienVault OTX: https://otx.alienvault.com/indicator/domain/zoomtick.com URLhaus: https://urlhaus.abuse.ch/host/zoomtick.com/ ## ANALYST NARRATIVE ---------------------------------------------------------------- [Generated: 2026-03-19 05:27:37 UTC — narrative may predate facts above. Treat fields in TIMELINE / DETECTION EVIDENCE / INFRASTRUCTURE as authoritative if they differ from the prose below.] PhishDestroy has identified zoomtick.com as a medium-risk generic phishing domain. Such phishing threats are significant because they aim to deceive users into divulging sensitive information, potentially leading to identity theft or financial loss. The presence of this site highlights the ongoing risk of encountering fraudulent websites that pose as legitimate platforms. The domain zoomtick.com was registered through NameCheap, Inc. and was created recently, on February 21, 2026. It resolved to the IP address 144.91.101.115 and was listed on three independent security blocklists, reinforcing its malicious classification. VirusTotal scans flagged it as suspicious by four out of ninety-five security vendors. Its Gridinsoft trust score stands at 0 out of 100, indicating a very low trust level. Currently, the domain has been taken offline, and visitors encounter a message stating, "Sorry, the website has been stopped," which prevents further phishing activity. Users are advised to remain cautious and avoid interacting with any emails, messages, or links referencing zoomtick.com. It is important to verify the legitimacy of URLs before entering any personal or financial information on unfamiliar websites. Utilizing updated antivirus software and enabling browser security features can also help mitigate the risk of phishing attacks. If you suspect you have been targeted or compromised via this or similar domains, consider changing your passwords and monitoring your accounts closely. ## EVIDENCE HASHES ---------------------------------------------------------------- PhishDestroy Case ID: PD-20260202-E02017 Favicon SHA-256: 55f7d9e99b8e2d4e0e193b2f0275501e6d9c1ebd29cadbea6a0da48a8587e3e0 TLS cert SHA-256: d02ec21d4be9f0abd8335f3f652e41894b633b5033da6bceeb220e9ffa173ee2 ## SCORING METHODOLOGY ---------------------------------------------------------------- Composite score is NOT derived from VirusTotal alone. PhishDestroy aggregates: - VirusTotal positive ratio - Public blocklist consensus (MetaMask, ScamSniffer, OpenPhish, PhishTank, URLhaus, CryptoFirewall, SEAL, Polkadot, Enkrypt, Phishunt, DiscordPhishing, PhishingDB) - Cloaking detection (HTTP 666 or rendering delta between bot and real visitor) - DNS-filter consensus (Quad9, CleanBrowsing, NextDNS, AdGuard, Cloudflare, etc.) - AlienVault OTX pulses + Cloudflare Radar + Google Safe Browsing - URLScan / URLQuery verdicts - Brand-impersonation heuristics (DOM analysis of forms, logos, wording) - Known phishing-kit fingerprinting (favicon hash, JS obfuscation signatures) - Wallet-drainer family classification (Angel, MS, Rainbow, Pink, Inferno, ...) - Free-TLS vs paid-cert ratio (throwaway infrastructure signal) - Registrar/hosting abuse history (this registrar's track record) - Human researcher sign-off (volunteer takedown team) A domain present in our database is ALREADY flagged. A low VT count by itself does NOT mean the domain is safe — new scam domains routinely show 0/95 VT for their first 7–30 days while actively draining wallets. Always cross-reference the composite score and the individual indicators above, not just VT. ## CORRECTIONS / APPEALS ---------------------------------------------------------------- Full HTML report: https://phishdestroy.io/domain/zoomtick.com/ JSON API: https://api.destroy.tools/v1/check?domain=zoomtick.com Appeal a flag: https://phishdestroy.io/appeals/ (responded to within 48 hours, FP rate <0.01%) Submit a report: https://t.me/PhishDestroy_bot About PhishDestroy: volunteer-driven open-source threat-intelligence platform. Tracked: 131,000+ phishing domains. Confirmed takedowns: 91,000+. Site: https://phishdestroy.io