zoom5[.]sbs

The domain zoom5.sbs was registered on February 21, 2026 and is presently taken offline. VirusTotal analysis shows that four of ninety‑three security vendors have flagged the domain, indicating a non‑trivial detection rate for malicious activity. The site carries a zero‑score trust rating from Gridinsoft (0/100) and is listed on a single external blocklist, confirming that at least one security feed has identified it as hostile. Network telemetry reveals that the domain resolves to the IP address 199.59.243.228, which belongs to Amazon.com, Inc. (AS16509) and is geolocated in the United States.

The SSL certificate associated with the host is rated R13, a low trust level that further suggests an insecure or malicious deployment. PhishDestroy has explicitly blocked the domain, providing additional confirmation of its use in phishing campaigns. While the page title returned by the server is simply "zoom5.sbs," no further content analysis is available, leaving the exact phishing payload or targeted brand undefined.

Defenders should treat any historical traffic to this host as potentially compromised, block the domain at DNS and firewall layers, and monitor for residual connections to the associated IP address. Incident response teams should also review logs for any authentication attempts or credential submissions that may have been directed to zoom5.sbs during its active period, and consider resetting affected accounts. Ongoing intelligence gathering is advised to confirm whether related subdomains or infrastructure components are being reused in future campaigns.