zoomklick[.]net

Analysis of zoomklick.net indicates an active generic phishing infrastructure observed on July 24, 2026. The domain was registered on February 23, 2026 through RegistryGate GmbH and is hosted behind Cloudflare, using the nameservers aaden.ns.cloudflare.com and betty.ns.cloudflare.com. DNS resolution points to IP address 188.114.97.3, which belongs to AS13335 Cloudflare, Inc. and is geolocated in the United States. HTTP probing returns a 526 status code, suggesting an SSL handshake issue despite the presence of a valid Let's Encrypt certificate (E8).

The site presents a page title identical to the domain name, zoomklick.net, but no additional content has been publicly documented. Reputation scoring is extremely low, with Gridinsoft assigning a trust score of 0 out of 100. The domain appears on three security blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal analysis shows that one of ninety‑three security vendors flagged the domain, reinforcing the high‑risk classification.

Given the combination of a recent registration, use of reputable CDN services to obscure origin, a low trust score, and inclusion on multiple blocklists, defenders should treat traffic to zoomklick.net as malicious. Recommended mitigation steps include adding the domain and its resolving IP to network deny lists, configuring web proxies to block HTTP requests returning a 526 response from this host, and monitoring for credential‑theft attempts that may target users through email or social media vectors. Continuous re‑evaluation is advised, as additional indicators such as payload samples or phishing page screenshots may emerge, but current evidence already warrants a high‑severity response.