zoomweb[.]chat

zoomweb.chat was flagged on July 12, 2026 as an active generic phishing site. The domain was registered on March 27, 2026 through NICENIC INTERNATIONAL GROUP CO., LIMITED and currently resolves to the Cloudflare edge address 172.67.222.16, which is located in Canada. The site returns an HTTP 403 status and the page title observed is “Just a moment…”, a common placeholder shown by Cloudflare when access is restricted. The DNS configuration uses the Cloudflare authoritative nameservers reese.ns.cloudflare.com and blakely.ns.cloudflare.com. The TLS certificate presented is issued by Google Trust Services under the WE1 identifier, indicating a valid HTTPS handshake despite the underlying malicious intent. A Gridinsoft trust score of 0 out of 100 further confirms the hostile nature of the host. The domain appears on a single security blocklist and is currently listed by PhishDestroy as blocked. Open‑source threat feeds add weight to the assessment. AlienVault OTX references the domain in eight separate pulses, and VirusTotal records two detections out of ninety‑five scanning engines, both of which are consistent with a low‑visibility phishing operation. The limited number of detections suggests that the campaign may be in an early stage or is employing evasion techniques to avoid broader detection. Defenders should immediately block zoomweb.chat at perimeter and DNS layers, and add the underlying IP 172.67.222.16 to deny lists where feasible. Continuous monitoring of the associated Cloudflare nameservers is advised, as future sub‑domains or re‑hosted payloads could appear under the same infrastructure. Security teams should also share the indicator with threat‑intelligence platforms to improve collective coverage.