unzoom[.]press

Analysis of the domain unzoom.press confirms its classification as a generic phishing site, currently active and resolving to infrastructure within AS8560 (IONOS SE) in Germany. The domain was registered on March 16, 2026, through InterNetX GmbH, with nameservers docks20.rzone.de and shades13.rzone.de. It resolves to IP address 217.160.0.52 and returns an HTTP 200 status, though the page title 'STRATO - Domain reserved' suggests either a placeholder or a deceptive front for malicious operations. No SSL certificate is present, increasing the likelihood of unencrypted credential harvesting or other phishing tactics. The domain appears on three security blocklists and is flagged by multiple independent detection systems, including PhishDestroy, MetaMask, and SEAL. VirusTotal reports that 2 out of 95 security vendors have detected malicious activity associated with unzoom.press, a low but non-zero confirmation of its threat status. The Gridinsoft trust score of 0/100 further supports the assessment of high risk. While the exact phishing kit or targeted brand remains undisclosed, the domain’s infrastructure and detection history align with patterns observed in credential theft and fraudulent schemes. Defenders should treat unzoom.press as an active threat. Network-level blocking of the domain and its resolving IP (217.160.0.52) is recommended, particularly in environments where phishing mitigation is a priority. Monitoring for connections to the associated nameservers (docks20.rzone.de, shades13.rzone.de) may also aid in identifying compromised systems or lateral movement attempts. Given the domain’s recent registration and lack of legitimate content, its continued use is likely tied to short-term phishing campaigns rather than long-term infrastructure.