zoomfx[.]io

ZoomFx.io was registered on May 28, 2026 and resolves to 118.139.182.100, an address hosted in Singapore and associated with GoDaddy's infrastructure. The site presents a valid Let's Encrypt R12 certificate and returns HTTP 200 with the page title “ZoomFx”. An MX record (mail.zoomfx.io) is configured, indicating the domain can receive email. Analysis on VirusTotal shows that 3 of 95 security vendors have flagged the domain, and the host appears on three public blocklists. The domain is currently listed as active and classified as a high‑risk generic phishing operation. The limited vendor consensus suggests the payload may be evolving or that detection signatures are still emerging. Open questions remain regarding the specific content delivered to victims. No malware samples or URLs beyond the landing page have been observed, and the branding hints toward a possible impersonation of Zoom services, but no direct references to the Zoom brand are present in the captured page title. The presence of an MX record suggests the operators may also be attempting credential harvesting via email. Defenders should add zoomfx.io to outbound and inbound filters, monitor DNS queries for the IP address 118.139.182.100, and enforce TLS inspection to detect any credential submission. Email gateways should block or quarantine messages from mail.zoomfx.io, and security teams should continue to track updates on blocklists and VirusTotal for additional detections.