Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Malwarebytes forum staff acknowledged a phishing-related block report for zsthost.com and mail.zsthost.com on January 7, 2024, and said the block would be removed in the next database update, usually within about an hour. The thread documents a reported false positive and an announced remediation—not a current safety certification for either domain.
What happened
The incident was reported in Malwarebytes Forums’ False Positives → Website Blocking section on January 7, 2024. The thread title was “False positive – mail.zsthost.com & zsthost.com.” The original post, by the account zst, identified two URLs that Malwarebytes was reportedly blocking as phishing sites:
As an Amazon Associate I earn from qualifying purchases.
zsthost.commail.zsthost.com
The primary record is the Malwarebytes forum thread. The report concerned a website-reputation block, not a confirmed malware infection on a visitor’s computer.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhat the poster said about the domains
The forum poster said that zsthost.com was a simple HTML landing page for an email-hosting company. They described mail.zsthost.com as a Roundcube webmail login used by customers. The poster said they did not know why either address had been flagged and invited Malwarebytes to request changes or further information.
#1 Best Overall
Those descriptions are statements attributed to the person who reported the block. The thread does not independently verify the company’s ownership, the site’s infrastructure, the Roundcube installation, or the domains’ present content.
How Malwarebytes responded
A Malwarebytes staff member, blender, replied on January 7, 2024: “Block will be removed next database update. Usually takes about an hour.” This is the decisive resolution recorded in the thread: Malwarebytes accepted the report for remediation and indicated that its blocking data would be changed.
The topic was later locked, so no further replies appear in the thread. The staff message is preserved in the discussion’s response record at the Malwarebytes comment link.
What the thread confirms—and what it does not
| Confirmed by the forum record | Not independently confirmed by that record |
|---|---|
| A block was reported for both domains. | The domains’ current reputation in 2026. |
| The report was filed on January 7, 2024, in Website Blocking. | An independent security audit or penetration test. |
| Malwarebytes staff responded to the report. | The exact moment the database change completed. |
| Staff said removal would occur in the next database update. | Permanent safety, ownership, content, or infrastructure after the response. |
| Staff estimated the update would usually take about an hour. | Whether every Malwarebytes product, version, region, or user received the same result. |
Accordingly, the most accurate wording is: Malwarebytes said it would remove the block in the next database update, typically within about an hour. The available thread does not show a dated follow-up test proving completion or continued unblocking.
What “false positive” means in this case
A false positive occurs when a security product classifies a benign or non-malicious resource as dangerous. Here, the reported classification was a phishing-related website block. That label should not be expanded into a claim that Malwarebytes found malware on a user’s device or that the domains were subject to a confirmed compromise.
Removing a block means the vendor changed, or intended to change, its reputation or blocking data. It does not guarantee that every page, subdomain, account, redirect, email message, or future version of a site will remain safe. Reputation decisions can change when ownership, DNS records, hosting, certificates, redirects, embedded resources, or content change.
Why a root domain and a webmail subdomain can be treated differently
zsthost.com and mail.zsthost.com are separate hostnames. A clean landing page does not establish that a webmail endpoint is clean, and a problem on a subdomain does not automatically describe the root domain. Security systems may score each hostname, URL path, redirect chain, or hosting relationship separately.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A legitimate login page can also be imitated by a lookalike domain. Users should verify the exact hostname before entering credentials, even when a genuine service is known to exist at a similarly named address.
Best Value
How to document a similar Malwarebytes block
Site owners and administrators can make a false-positive report more actionable by preserving the precise evidence below:
- Exact address: Record the full URL, including protocol, subdomain, path, query string, and port if present.
- Product details: Note the Malwarebytes product, platform, component, and version that generated the warning.
- Displayed classification: Copy the alert text exactly, such as phishing, malicious, suspicious, or unwanted.
- Time and date: Include the detection timestamp and time zone.
- Visual proof: Save a screenshot of the alert and the browser address bar.
- Scope: Test whether the result occurs on one device, account, network, or multiple independent environments.
- Redirects: Record every redirect and destination rather than reporting only the first address.
- Affected surface: Specify whether the root domain, a subdomain, a path, or a particular asset is blocked.
Use a vendor’s official false-positive channel or forum and provide contact details that can be independently associated with the site. Do not remove security controls or alter production content solely to make a warning disappear.
If the block remains after the announced update
- Update Malwarebytes’ threat-intelligence or database components, then restart the application if requested.
- Recheck the exact hostname and URL; a cleared root domain does not imply that every subdomain is cleared.
- Compare results from a separate, trusted network to identify local DNS, browser, proxy, or gateway caching.
- Clear only relevant local caches after recording the original evidence.
- Return to the support thread or submit a new report with the original alert, timestamp, product version, and current behavior.
- Keep protection enabled globally. If business operations require access while a review is pending, use a narrowly scoped, temporary exception only under an administrator’s risk policy.
A stale local result can persist after a vendor changes its reputation data. Conversely, a later block may reflect changed content, a compromised server, a new redirect, or a different URL than the one originally reviewed.
Recommended Free Tools
What visitors should do
- Do not automatically dismiss a warning just because a site operator calls it a false positive.
- Verify the domain through an independently trusted channel, such as a known company contact or previously documented bookmark.
- Avoid entering passwords or payment details while the classification is unresolved.
- Check the complete hostname for lookalike spelling, unexpected subdomains, and redirects.
- Do not disable Malwarebytes or other protection globally to reach one page.
Bottom line
The January 7, 2024 Malwarebytes forum thread records a reported false positive involving zsthost.com and mail.zsthost.com. Malwarebytes staff said the block would be removed in the next database update, generally within about an hour. That response documents intended remediation, but it does not prove the exact completion time, establish a permanent unblocked state, or certify that either domain is safe today.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
