zoom[.]mssg[.]me

zoom.mssg.me is flagged as a brand‑impersonation site that mimics the Zoom brand. The domain was registered on 21 Feb 2026 and currently returns HTTP 200 with a page title of “zoom”. It presents a valid TLS certificate issued by Let’s Encrypt (YE1) and enforces HSTS, indicating an attempt to appear legitimate. The underlying infrastructure points to Cloudflare’s network; the domain resolves to 172.67.75.137, a Cloudflare‑owned address located in Canada. The site loads Google Tag Manager, Google Analytics, and Cloudflare Browser Insights, suggesting the use of common web‑tracking kits. VirusTotal reports a single detection out of 95 scanners, and Gridinsoft assigns a trust score of 0 / 100. The host is listed on three public blocklists and is actively blocked by PhishDestroy, MetaMask and SEAL. Available intelligence does not include a content dump or sample of any credential‑stealing form, so the exact malicious payload remains unknown. The page title is the only visible artifact, and no additional redirects or download behavior have been observed. Consequently, while the infrastructure confirms a high‑risk impersonation campaign, the precise attack vector cannot be confirmed without further traffic capture. Defenders should treat zoom.mssg.me as malicious. Immediate actions include adding the domain to URL filtering rules and, where feasible, blocking the associated IP address. Because the IP belongs to a shared Cloudflare pool, domain‑based blocking is preferred to avoid collateral impact. Continuous monitoring of DNS queries for the domain and related sub‑domains is advised, as is the inclusion of the host in threat‑intel feeds. Organizations using Zoom should reinforce user awareness of official communication channels and enable multi‑factor authentication to mitigate credential compromise.