zoomsolar[.]us

Analysis of zoomsolar.us shows a newly registered domain (created 14 Apr 2026) that is being used for a high‑risk brand‑impersonation campaign targeting Zoom users. The site resolves to 104.21.24.105, hosted behind Cloudflare (nameservers eloise.ns.cloudflare.com and simon.ns.cloudflare.com) and presents a valid Let’s Encrypt certificate (E8). The page title “Zoom Solar by Gulf Electrical Services – Places Review” indicates an attempt to masquerade as a Zoom‑related service, but the underlying content has not been publicly examined. Detected web‑stack components include WordPress, MySQL, PHP, jQuery, Google Analytics, Google AdSense, and Funding Choices, suggesting a standard CMS deployment rather than a custom credential‑harvesting platform. The domain is listed on three security blocklists and is actively blocked by PhishDestroy, MetaMask, and SEAL. Gridinsoft assigns a trust score of 0/100, and VirusTotal reports 3 of 94 scanners flagging the domain. The infrastructure is consistent with other recent Zoom‑impersonation operations, using Cloudflare’s CDN to obscure origin. Defenders should add zoomsolar.us to URL filtering and email gateway deny lists, monitor DNS queries for the associated IP, and consider sink‑hole or sink‑routing of traffic to mitigate potential user exposure. Continuous re‑assessment is advised, as the site remains active and may evolve its payload or landing pages.