fr20web-zoom[.]com

This domain carries an elevated risk level and has been identified as a generic phishing threat, likely targeting Zoom users with fake login pages or credential harvesting attempts. The site is currently offline, but its past activity suggests it was part of a broader phishing campaign. PhishDestroy assesses that while the domain no longer resolves, the threat actors behind it may deploy similar domains in the future.

The domain was registered through NICENIC INTERNATIONAL GROUP CO., LIMITED on June 15, 2026, and resolved to IP address 95.215.32.32. It held an SSL certificate from Let's Encrypt (YR2), which lent it a false sense of legitimacy. VirusTotal data shows 5 out of 95 security vendors flagged this domain, indicating moderate detection coverage. The domain appears on three security blocklists, and its page title was "Access Denied," likely an attempt to appear legitimate or to block automated scanners. The combination of a recently created domain, a generic registrar, and a low trust score (implied by the flagging rate) strongly suggests malicious intent.

To protect against similar generic phishing attacks, users should verify URLs carefully, especially those claiming to be from Zoom or other popular services. Avoid clicking links in unsolicited emails or messages, and always navigate directly to the official website. Enable multi-factor authentication on all accounts and use a reputable security solution that can block known phishing domains. If credentials were entered on this domain, change passwords immediately and monitor accounts for suspicious activity.