Indicator zoomconference.sbs Type domain Category Lure Page Confidence high VT Score 14/94 Source urlscan First Seen 2026-04-18 13:31:12 UTC Last Seen 2026-04-26 08:00:28 UTC urlscan View scan result ↗
Raw JSON
{
  "submitter": {},
  "task": {
    "visibility": "public",
    "method": "api",
    "domain": "zoomconference.sbs",
    "apexDomain": "zoomconference.sbs",
    "time": "2026-04-07T08:00:01.434Z",
    "uuid": "019d66f4-8716-77f9-84a1-5feecf423e7f",
    "url": "https://zoomconference.sbs/ZmC/",
    "tags": [
      "@ecarlesi",
      "threat",
      "malware"
    ]
  },
  "stats": {
    "uniqIPs": 4,
    "uniqCountries": 2,
    "dataLength": 115429,
    "encodedDataLength": 100112,
    "requests": 7
  },
  "page": {
    "country": "DE",
    "server": "nginx",
    "redirected": "same-domain",
    "ip": "89.163.155.33",
    "apexDomainAgeDays": 0,
    "language": "en",
    "mimeType": "text/html",
    "title": "Zoom Client Update",
    "url": "https://zoomconference.sbs/ZmC/Windows/invite.php",
    "tlsValidDays": 89,
    "tlsAgeDays": 0,
    "ptr": "89.163.155.33.bwys.net",
    "domainAgeDays": 0,
    "tlsValidFrom": "2026-04-06T11:40:21.000Z",
    "domain": "zoomconference.sbs",
    "apexDomain": "zoomconference.sbs",
    "asnname": "MYLOC-AS WIIT AG, DE",
    "asn": "AS24961",
    "tlsIssuer": "R12",
    "status": "200"
  },
  "_id": "019d66f4-8716-77f9-84a1-5feecf423e7f",
  "_score": null,
  "sort": [
    1775548801434,
    "019d66f4-8716-77f9-84a1-5feecf423e7f"
  ],
  "result": "https://urlscan.io/api/v1/result/019d66f4-8716-77f9-84a1-5feecf423e7f/",
  "screenshot": "https://urlscan.io/screenshots/019d66f4-8716-77f9-84a1-5feecf423e7f.png"
}

Campaign cluster — 60 pivot-discovered domains

Domain VT Score
acrobat-reader.live 0/94
milevault.com 0/94
www.oktaportalesignatureauthentication.zehetang.com 7/94
www.portalokta.zehetang.com 0/94
cpcontacts.auth-firstmontanabank.com 10/94
mail.auth-firstmontanabank.com 15/94
lloyds-secure-id.com 2/94
portalokta.zehetang.com 1/94
memosecure.windstuff.com 2/94
89.163.155.33 0/94
sanxinenv.com.greeksgrill.com 0/94
docusigned.sbs 5/94
meetinginvitation.us 8/94
oktaesignauthentication.sanxinenv.com 0/94
www.sanxinenv.com.greeksgrill.com 0/94
www.oktaesignauthentication.sanxinenv.com 0/94
www.oktaportalthentication.zehetang.com 0/94
ledgershieldintl.com 0/94
whm.easyapp.guru 0/94
xopenportfolio.com.ledgershieldintl.com 1/94
www.xopenportfolio.com.ledgershieldintl.com 0/94
legacyrockftm.com 1/94
althani-leshabank.com.uae-habtoor.com 0/94
waplsapp.com 15/94
www.auth-tnbank.com 2/94
www.althani-leshabank.com.uae-habtoor.com 0/94
auth-tnbank.com 2/94
auth-cbhutch.com 2/94
www.chatidzoommeeting.com 0/94
webinvitemeeting.com 19/94
auth-whitakerbank.com 0/94
auth-tsbank.com 17/94
auth-ubankonline.com 13/94
auth-firstmontanabank.com 17/94
accesmosokat.dgshaoshuai.com 0/94
auth-bruningbank.com 8/94
auth-bankofkaukauna.com 9/94
globaltrustunion.com.foxlineslogistics.com 11/94
www.globaltrustunion.com.foxlineslogistics.com 7/94
www.zoominvitemeetingsetup.vip.zoommeetingsetup.info 7/94
www.cmbescrows.com.uae-habtoor.com 0/94
promanager.outboundciwidey.com 17/94
sanxinenv.com 0/94
auth-reliancebankmn.com 9/94
adobeacrobats.sbs 1/94
www.venezabank.com.seguropacote.com 10/94
venezabank.com 6/94
auth-pinecountrybank.com 0/94
adobeacrobats.online 14/94
mail.zehetang.com 0/94
www.zehetang.com.greeksgrill.com 0/94
www.zehetang.com 0/94
zehetang.com 1/94
auth-cornhuskerbank.com 3/94
brunertrust.com 0/94
capitalstrengthloan.co.za.elpatcash-finance.co.za 0/94
auth-firstmissouri.com 3/94
auth-pebank.com 9/94
internalmemorecord.bxwancheng.com 16/94
auth-onelocalbank.com 3/94