zoompa-app[.]cfd

The domain zoompa-app.cfd is currently flagged as a high‑risk generic phishing site. Registration data shows the domain was created on 30 November 2024 through Web Commerce Communications Limited and is served by Cloudflare nameservers etienne.ns.cloudflare.com and melina.ns.cloudflare.com. DNS resolution points to IP 172.67.161.194, which belongs to AS13335 Cloudflare, Inc. in the United States. The web server returns an HTTP 301 redirect and presents the default Apache2 Ubuntu page titled “Apache2 Ubuntu Default Page: It works”, indicating that no malicious landing page has been observed at the time of analysis. SSL is provided by Google Trust Services under the WE1 certificate, confirming the use of a valid TLS certificate issued by a trusted authority.

Reputation signals are strongly negative. Gridinsoft assigns a trust score of 0 / 100, and the domain appears on one security blocklist. PhishDestroy has already blocked the domain, and VirusTotal reports that four of ninety‑three scanning engines flag the domain as malicious. The presence of Cloudflare and HTTP/3 suggests the operators are leveraging a reputable CDN to hide origin infrastructure. Evidence confirms active status; the domain remains reachable and continues to resolve to the same Cloudflare‑hosted IP.

However, the exact phishing payload, targeted brand, or credential‑collection page has not been disclosed, and the default Apache page may be a placeholder pending further development. Defenders should continue to block the domain at perimeter filters, update threat‑intelligence feeds with the observed indicators (domain, IP, nameservers, SSL fingerprint), and monitor for any changes in the HTTP response that could reveal a malicious front‑end. Because the infrastructure is hosted on a widely used CDN, additional scrutiny of traffic patterns to the IP may be required to differentiate legitimate Cloudflare traffic from malicious activity.