Análisis de phishing y seguridad de zoom657.live

The domain zoom657.live was registered on May 18, 2026 through NameCheap, Inc. The registration is accompanied by a Sectigo Limited public server authentication DV certificate issued by Sectigo Public Server Authentication CA DV R36. Gridinsoft assigned a trust score of 0 out of 100, indicating a lack of reputation. VirusTotal records a single detection out of 95 security vendors, confirming that at least one vendor has flagged the domain as malicious.

Network analysis shows that zoom657.live resolves to the IPv4 address 198.54.116.133, an address owned by Namecheap, Inc. and geolocated to the United States. The domain uses the default Namecheap hosting nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com. MX records are configured with mx1-hosting.jellyfish.systems (priority 5) and a second host (priority 10). An HTTP GET to the root returns status code 200, indicating an active web service.

Threat intelligence sources place the domain on three security blocklists and it appears in one AlienVault OTX pulse. The domain is currently blocked by the PhishDestroy, MetaMask, and SEAL blocklists. The classification assigned is generic_phishing with a high risk level, and the operational status remains active. Although only a single VirusTotal vendor flagged the domain, the combination of a zero trust score, active hosting, and blocklist presence supports a high confidence assessment of phishing intent.

Defenders should add zoom657.live to network deny lists and monitor DNS queries for the domain. Email gateways should treat any messages originating from the domain or its MX hosts as malicious. Continuous scanning of the associated IP address 198.54.116.133 is advised to detect any lateral activity. Incident response teams should treat any observed credential submission to the site as a compromise and initiate credential reset procedures.