tuzoom011[.]com

tuzoom011.com was registered on 2026-05-06 through XServer, Inc. The domain is delegated to five XSERVER name servers (ns1‑ns5.xserver.jp). DNS resolution points to the IPv4 address 85.131.221.21, which resolves to a hosting location in Japan operated by XSERVER Inc. The site serves content over HTTPS using a Let’s Encrypt R12 certificate, and an HTTP GET returns status code 200.

The landing page presents a title rendered as garbled Japanese characters (¥¨¥Ã¥¯¥¹¥µ¡¼¥Ð¡¼ ¥µ¡¼¥Ð¡¼½é´ü¥Ú¡¼¥¸), a pattern often observed in malicious phishing pages that attempt to evade simple language filters. The host has a Gridinsoft trust score of 0 out of 100, indicating a lack of reputation. The domain appears on three public blocklists and is actively blocked by three independent anti‑phishing feeds, including PhishDestroy, MetaMask, and SEAL.

AlienVault OTX includes this domain in a single threat pulse, providing additional corroboration of its malicious use. No detections were recorded on VirusTotal at the time of analysis, but the absence of detections does not imply safety, especially given the low trust score and active blocklist presence. The combination of a newly created domain, Japanese hosting, a generic phishing page, and multiple blocklist entries justifies a high‑risk rating.

Defenders should add tuzoom011.com to network and endpoint deny lists, enforce DNS sinkholing, and monitor outbound connections to 85.131.221.21. Continuous observation of the associated IP and any future DNS changes is advised, as the infrastructure could be repurposed for additional campaigns. Organizations should also educate users about the likelihood of credential‑stealing pages hosted under this domain.