zibber020[.]com

Analysis of zibber020.com shows a newly registered domain (created 5 July 2026) that resolves to 178.16.54.222, an address allocated to AS202412 Omegatech LTD in the Netherlands. The domain uses the ns3.my-ndns.com and ns4.my-ndns.com name servers and serves a TLS certificate from Let’s Encrypt (YR1). HTTP requests return a 302 redirect and the sole observed page title is “Just a moment…”. The site is flagged by multiple threat feeds: two of ninety‑one VirusTotal scanners have raised alerts, it appears on one public blocklist, and PhishDestroy has listed it as blocked. Infrastructure fingerprints include Varnish caching, Amazon Web Services hosting, HSTS enforcement, and Amplitude analytics. AlienVault OTX contains a single pulse referencing the domain. The combination of recent registration, low trust score (0/100), and active status aligns with the generic credential‑phishing classification. No additional content or victim interaction details are publicly available, so the precise phishing payload remains unknown. Defenders should block the domain and its associated IP at network perimeters, monitor DNS queries for the listed name servers, and consider adding the indicator to endpoint and email filtering rules. Ongoing observation of the IP and any new payloads is recommended.