zoomaccounts[.]shop

Analysis of zoomaccounts.shop indicates a credential‑phishing operation targeting Zoom users. The domain was registered on March 10, 2026 through HOSTINGER operations, UAB and resolves to IP 147.93.42.129, which is hosted by Hostinger International Limited (AS47583) in the United States. Infrastructure fingerprints reveal the use of LiteSpeed web server, HTTP/3 support, and nameservers horizon.dns-parking.com and orbit.dns-parking.com. No TLS certificate is presented, leaving the site unencrypted and increasing exposure to interception.

The page title observed during capture reads "zoomaccounts.shop | Zoom Account Plans for Business Meetings," aligning with the declared scam type of credential phishing. The site has been taken offline, but its presence on three security blocklists and active blocking by PhishDestroy, MetaMask, and SEAL demonstrate that multiple threat‑intelligence feeds have identified it as malicious. VirusTotal scans show three of ninety‑four security vendors flagging the domain, reinforcing the malicious classification. While the site is currently offline, defenders should continue to block the domain and its associated IP address at perimeter defenses, DNS resolvers, and proxy filters.

Monitoring for re‑registration or reuse of the same hosting infrastructure is advised, as threat actors often recycle assets. Additionally, security teams should alert end users about unsolicited Zoom‑related communications that reference account plans, reinforcing the need to verify URLs before credential entry. Continuous enrichment of threat‑intel feeds with this domain’s identifiers will aid in rapid detection should the actor reactivate the site or launch a successor campaign.