zoomwebinarmessage[.]shop

The domain zoomwebinarmessage.shop was registered on April 27, 2026 through Namecheap, Inc. The site currently returns HTTP 200 and presents a page titled “Slider Challenge”. Its registration date places it well within the typical lifecycle of recent phishing campaigns, and the active status indicates the site is still reachable. Infrastructure analysis shows the domain resolves to the Cloudflare‑owned address 104.21.74.149, located in Canada. Authoritative nameservers are beth.ns.cloudflare.com and troy.ns.cloudflare.com, confirming the use of Cloudflare’s DNS service. The TLS certificate is issued by Google Trust Services under the WE1 root, providing a valid HTTPS connection but offering no assurance about the underlying content. Threat intelligence flags the domain on three public blocklists and records it in one AlienVault OTX pulse. Four of ninety‑five VirusTotal scanners have raised detections, and the site is listed by PhishDestroy, MetaMask, and SEAL as malicious. Gridinsoft assigns a trust score of 0 out of 100, reflecting a high confidence that the domain is being used for malicious purposes. While the available data confirm the presence of malicious infrastructure and multiple detections, the exact payload or credential‑harvesting mechanisms have not been publicly disclosed. Defenders should block DNS resolution for zoomwebinarmessage.shop, enforce URL filtering, and monitor outbound traffic for connections to the associated IP address. Additional sandbox analysis of the page content is recommended to identify any embedded scripts or redirects that could be leveraged in a phishing campaign.