zoomapplicantinvites[.]com

This investigation documents the infrastructure associated with zoomapplicantinvites.com, a domain observed in a brand‑impersonation campaign targeting Zoom users. The domain was registered on 21 February 2026 through NameSilo, LLC and is currently offline. DNS resolution points to the IPv4 address 89.163.155.33, which belongs to the German autonomous system AS24961 operated by WIIT AG. The authoritative name servers are ns7.privatedns.vip and ns8.privatedns.vip, both hosted on the same provider. No TLS certificate is presented for the site, indicating that HTTPS was not configured at the time of capture.

The page title returned by HTTP requests is “Download Zoom,” matching the declared brand target. Gridinsoft assigned a trust score of 0 out of 100, reflecting a high likelihood of malicious intent. VirusTotal analysis shows that 16 of 95 scanned security vendors flagged the domain as malicious, reinforcing the suspicion. The domain appears on three external blocklists and has been actively blocked by PhishDestroy, MetaMask, and SEAL. These multiple detections suggest that the infrastructure was used to distribute a malicious payload or to harvest credentials, although the exact payload type and victim interaction flow have not been publicly released.

Because the site is offline, live probing is not possible, leaving the content of the landing page and any associated command‑and‑control endpoints uncertain. Defenders should continue to monitor the IP address 89.163.155.33 for any resurgence, enforce outbound filtering to block connections to the listed nameservers, and add zoomapplicantinvites.com to internal blocklists. Organizations using Zoom should remind users that official Zoom downloads are delivered exclusively through zoom.us domains and that any request to “download Zoom” from unrelated hosts should be rejected. Ongoing threat‑intel feeds should be consulted for potential re‑use of the same infrastructure in future campaigns.