It Looked Like Zillow. It Wasn't: Inside the zillowofficial.com Investment Scam

1. Methodology

This investigation combined domain registration analysis (WHOIS/RDAP), certificate transparency review (crt.sh), DNS enumeration, typosquat clustering (dnstwist), and isolated content rendering via urlscan.io, cross referenced against VirusTotal domain and URL reputation data. A legitimate baseline (zillow.com) was profiled in parallel for comparison.

2. What the Website Appears to Be

Confirmed facts

zillowofficial.com is styled to resemble Zillow, the large, publicly traded (NASDAQ: Z/ZG) US real estate marketplace. It is not an official Zillow Group domain.

The rendered page title is “Zillow,” but the visible content is unrelated to Zillow's actual business. The headline reads “Unlock Canada's Real Estate Opportunities,” with sub copy “Unlock Exclusive Listings in Canada's Top Real Estate Spots.” Zillow does not operate an official Canadian real estate marketplace under this domain or brand.

The site's internal navigation menu, extracted via urlscan.io text content analysis, includes: Profile, Withdraw, Membership, Search Property, Property History, Event/VIP Benefits, Account details, Agent Support. The presence of “Withdraw” alongside “Membership” and property listings is inconsistent with a real estate marketplace and consistent with the structure of an investment-style scam platform.

An error message embedded in the page's non-JavaScript fallback content identifies the underlying platform by name: “We're sorry but godabook doesn't work properly without JavaScript enabled.” This is very likely the name of the scam kit powering the site.

Listed property addresses (Ontario, Canada) differ between this domain and a structurally identical sister site, consistent with dynamically generated or randomized listing content.

Analytical judgment: the site is not a Zillow credential phishing clone. It uses Zillow's name as a trust signal while delivering unrelated content consistent with a fraudulent investment platform targeting a Canadian real estate audience.

Status update: Since this investigation was conducted, zillowofficial.com is no longer active. The site's disappearance does not invalidate the evidence collected while it was live, and it does not establish why the site became inactive or whether related domains remain active.

3. Legitimacy Assessment: Malicious, Supported by Multiple Independent Indicators

Confirmed facts

WHOIS/RDAP: the domain was registered on 2026-06-29T02:09:40Z, roughly five weeks before this investigation, through registrar Gransy, s.r.o. (Czech Republic). Name servers are Cloudflare's (arch.ns.cloudflare.com, jasmine.ns.cloudflare.com).

Certificate Transparency (crt.sh): five TLS certificates were logged the same day as registration (2026-06-29), issued automatically via Let's Encrypt and Google Trust Services, including wildcard coverage (*.zillowofficial.com). Certificate issuance matching registration within hours indicates automated, templated deployment.

DNS: no MX record is configured (ANSWER: 0 on an MX query), meaning the domain cannot send or receive email, consistent with a front site rather than an operating business.

VirusTotal domain reputation: 0/91 vendors flagged the domain at the time of lookup, and urlscan.io had no prior scan history before this investigation began. This reflects the domain's youth, not evidence of legitimacy.

A fresh, isolated urlscan.io scan returned a verdict of “Potentially Malicious,” flagged for “Phishing against: Generic (Online),” on two independent submissions (root domain and www subdomain).

Comparative baseline: zillow.com (confirmed legitimate)

The real Zillow domain was profiled for comparison: first indexed in 2011, TLS certificate issued by Amazon with 1 year validity, hosted on Amazon infrastructure (not a generic reverse proxy), and an extensive third party analytics/advertising stack (Google Sign-in, Facebook Pixel, Google Analytics, Datadog, among others). zillowofficial.com shares none of these characteristics.

Analytical judgment: the combination of a “Potentially Malicious” verdict, a same-day certificate-to-registration match, absent email infrastructure, and content unrelated to the borrowed brand is sufficient to move this assessment from “suspicious” to malicious, with moderate to high confidence. The remaining uncertainty is not about whether the site is fraudulent, but about the precise fraud mechanism, addressed in Section 4.

4. Who May Be Operating or Benefiting From It

Confirmed facts

No registrant identity is available; WHOIS registrant fields are redacted, standard practice for virtually all .com registrations since 2018 and not itself a suspicious indicator.

urlscan.io's “similar structure” detection identified 13 other domains sharing the same page structure, framework (Vue.js), and JavaScript signature (including the webpackChunkgodabook identifier), hosted on different IPs, domains, and ASNs. Visible examples: zoocasa-online-job.com, sothebysrealty-online-job.com, zolo-work.cc, honestdoor-job.com, thecanadianhome-online-job.com, antlerhomes-work.com — all borrowing the names of real, legitimate Canadian real estate platforms. These domains range from 7 months to 1 year old, indicating an operation active well before zillowofficial.com was registered.

Note: urlscan.io's structural similarity feature is explicitly labeled “experimental” by the vendor. It compares page structure (DOM, scripts, layout), not semantic content, and can occasionally group unrelated sites. Each of the 13 domains listed above was independently spot-checked (see zoocasa-online-job.com below) to confirm the match was substantive rather than a false positive of the algorithm.

Addendum (August 6, 2026): a re-scan of zillowofficial.com performed the day after this investigation began (urlscan.io/result/019fd722-0a11-705b-902c-451f53338587/) returned 14 structurally similar domains, one more than the original count captured below. This is noted as a supplementary observation rather than a re-analysis; it suggests the cluster is actively growing rather than static, which is consistent with the ongoing-campaign assessment in this report.

A manual content check of zoocasa-online-job.com confirmed it shares the identical navigation structure (“Withdraw,” “Membership,” etc.) and near-identical marketing copy as zillowofficial.com.

On the use of dnstwist: during the early stage of this investigation, dnstwist was run against zillow.com to check whether zillowofficial.com belonged to a cluster of typosquat permutations of the Zillow brand. It did not surface zillowofficial.com or any of the 13 domains later identified, because dnstwist's default fuzzing algorithms (bitsquatting, transposition, vowel swap, TLD swap, dictionary addition, etc.) do not generate a “brand + official” style permutation by default. This check was inconclusive rather than negative: it neither confirmed nor ruled out a shared actor, and was superseded by urlscan.io's structural similarity detection, which identified the cluster through page structure rather than domain name pattern. It is retained here as a documented step in the methodology, not as a source of findings.

Analytical judgment: the evidence points to a single operator or affiliate group running a template-based scam operation (“godabook” or a similarly named kit) across multiple domains, each impersonating a different real estate brand (Zillow, Zoocasa, Sotheby's Realty Canada, HonestDoor, and others) to widen its targeting reach. No further attribution can be responsibly established from passive open source data alone; this would require infrastructure-level investigation (hosting subpoena, payment processor tracing) outside the scope of passive OSINT.

5. Likely Targets

Analytical judgment, based on brand selection and content language:

Primarily English speaking individuals in Canada, given the “Canada's Real Estate Opportunities” framing and the cluster of impersonated Canadian real estate brands.

The use of the Zillow name, substantially more recognized than the Canadian brands in the cluster, suggests an attempt to expand the campaign's reach to a US or broader English-speaking audience already familiar with Zillow, despite Zillow not operating an official Canadian real estate marketplace under this domain or brand, a detail an attentive victim could use to identify the fraud.

Given the “Withdraw” and “Membership” structure, the likely victim profile matches other investment-style scams: individuals seeking passive income or property investment opportunities, approached via unsolicited outreach rather than organic search, consistent with the domain having zero organic search engine indexation.

6. Techniques, Services, and Infrastructure

Confirmed facts

Hosting/CDN: Cloudflare (AS13335), shared IP ranges, origin server not directly observable.

Frontend framework: Vue.js, single page application architecture (client-side rendered), which is why urlscan's static form detection returned “0 forms found in the DOM” despite the site almost certainly containing login/registration/deposit forms rendered dynamically.

Platform/kit identifier: “godabook,” found in a JavaScript-disabled fallback message and in a webpack chunk name (webpackChunkgodabook). A search for this string returned no public documentation or prior threat intelligence reporting, suggesting this kit is newly deployed, privately distributed, or not yet publicly analyzed.

Certificate issuance: automated (Let's Encrypt / Google Trust Services), consistent with rapid, repeatable deployment across the domain cluster.

Content generation: property listing details (addresses) differ between structurally identical instances, indicating templated or randomized content generation rather than manually curated listings.

Not established from available evidence: the true hosting origin behind Cloudflare, the specific data collection or payment mechanism used once a visitor registers, and the full scope of the domain cluster beyond the 13 similar pages surfaced by urlscan.io's experimental similarity detection.

7. Risks to Visitors or Potential Victims

Based on the confirmed “Withdraw/Membership” platform structure, the realistic risk profile includes:

• Fraudulent investment / deposit loss: the most likely primary risk. Victims are induced to deposit funds into a “membership” or “property investment,” see fabricated returns, and are ultimately unable to withdraw.

• PII and financial data harvesting: registration and “account details” sections likely collect personal and possibly banking information under a trusted-sounding brand.

• Credential reuse exposure: any password created on the platform, if reused elsewhere, could expose the victim's other accounts.

• Secondary social engineering: platforms of this type often escalate through direct contact (chat support, “agents”) to build trust before requesting larger deposits, consistent with the “Agent Support” menu item observed.

None of these are directly observed in this investigation (no registration was attempted, in line with passive/lawful scope) but are drawn from the confirmed platform structure and well documented patterns in this scam category.

8. Sources Consulted

Direct links and reference IDs are provided below for every source consulted, with the verification date and time where captured.

9. What Could Not Be Established

• The true identity of the domain's operator or beneficiary

• The true hosting origin behind Cloudflare

• The specific payment or data exfiltration mechanism used post-registration

• The full extent of the domain cluster (only 13 structurally similar domains were surfaced by an experimental detection feature; more likely exist)

• Any confirmed victim reports or financial loss figures tied specifically to this domain

Bottom Line

Based on independent confirmation from WHOIS/certificate timing, urlscan.io's malicious verdict, the site's internal “Withdraw/Membership” structure, and its membership in a 13+ domain cluster impersonating multiple real estate brands, this domain is assessed as malicious with moderate to high confidence, most consistent with a fraudulent real estate investment scam rather than classic credential phishing. Full attribution and the complete scope of the operation remain unconfirmed and would require active infrastructure investigation beyond passive OSINT.