zoomclean1[.]com

This domain, zoomclean1.com, is flagged as a high-risk phishing infrastructure impersonating a legitimate brand under the name 'زوم كلين' (Zoom Clean). Analysis indicates the site presents a fake login portal targeting Arabic-speaking users, likely designed to harvest credentials or distribute malicious payloads. The page title, الرئيسية - زوم كلين, suggests an attempt to mimic a trusted service, though no direct association with known drainer kits or cryptocurrency theft frameworks has been confirmed at this stage. Infrastructure analysis reveals the domain was registered on May 22, 2026, through HOSTINGER operations, UAB, a registrar frequently exploited for phishing campaigns. The domain resolves to the IP address 72.60.93.160, hosted in France, with a Let's Encrypt SSL certificate (R12) providing a false sense of security. VirusTotal detection stands at 1/95 security vendors, indicating low initial coverage despite its active malicious status. The domain appears on three security blocklists, and its hosting provider has not yet taken enforcement action. Google Safe Browsing (GSB) status remains unconfirmed but is likely to classify it as malicious given its current indicators. As of the latest assessment, zoomclean1.com remains active, with no evidence of takedown or mitigation by the hosting provider. The domain continues to serve phishing content, posing a persistent risk to users who may encounter it through spam, social engineering, or malvertising vectors. Response actions are limited to third-party blocklists, including PhishDestroy, MetaMask, and SEAL, which have flagged the domain. Users are advised to avoid interaction, and network administrators should implement DNS-level blocking for 72.60.93.160 and associated domains. The remaining risk is classified as high due to the domain's operational status and lack of registrar intervention.