zooma-amp432[.]online

This domain, zooma-amp432.online, is actively flagged as a high-risk brand impersonation targeting Zoom. Registered on March 25, 2026, through NameSilo, LLC, the site presents itself as 'Zooma Casino' with a page title in Russian indicating login and registration for a gambling platform. Infrastructure analysis reveals the domain resolves to IP 185.4.66.132 and uses a default SSL certificate, which is common in low-effort fraudulent operations. The domain appears in 22 threat intelligence pulses on AlienVault OTX and is listed on four security blocklists, including SEAL and MetaMask. Gridinsoft assigns it a trust score of 0/100, and five security vendors flag it on VirusTotal, though the specific detection rules are not detailed in available data. The site is linked to the Gambler Scam phishing kit, a known framework for fraudulent gambling operations. While the exact content and mechanics of the scam are not fully analyzed, the combination of brand impersonation, gambling-themed page title, and use of a known phishing kit strongly indicates malicious intent. Defenders should treat this domain as hostile and prioritize blocking or monitoring traffic to 185.4.66.132. No legitimate association with Zoom or authorized gambling services is confirmed, and the domain’s infrastructure aligns with patterns observed in other high-risk impersonation campaigns. Further analysis of the phishing kit’s behavior and network connections may provide additional indicators for detection and mitigation.