# PhishDestroy domain threat record: zoomservice.com.cn Content language: English Canonical HTML report: https://phishdestroy.io/domain/zoomservice.com.cn/ Machine-readable companion: https://phishdestroy.io/domain/zoomservice.com.cn/llm.txt ## Summary PhishDestroy stores a threat-intelligence record for this domain. This document reports the latest stored fields; it is not a real-time guarantee of availability or safety. ## Stored observations - Listed by PhishDestroy: yes - Availability at last stored check: observed active - First observed by PhishDestroy: 2026-10-20 13:26:14 UTC - Last availability or vendor check: 2026-10-22 10:30:06 UTC - Stored record updated: 2026-10-22 16:07:29 UTC - VirusTotal detections in the stored snapshot: 0/92 - Independent public blocklist matches in the stored snapshot: 2 - Matching public blocklists: MetaMask, SEAL - Google Safe Browsing stored result: no stored flag ## Stored classification - Targeted brand: Zoom ## Stored infrastructure - Observed IP address: 154.23.201.94 - Registrar in stored WHOIS data: 北京新网数码信息技术有限公司 - Last stored HTTP status: 200 - Registration date in stored WHOIS data: 2026-10-17 18:37:42 UTC ## Evidence links - URLScan report: https://urlscan.io/result/01a1597c-6922-701e-9719-e7fa33dc701b/ - VirusTotal domain view: https://www.virustotal.com/gui/domain/zoomservice.com.cn - Certificate Transparency search: https://crt.sh/?q=%25.zoomservice.com.cn - Web Archive lookup: https://web.archive.org/web/*/https://zoomservice.com.cn/ ## Corrections - Appeal or correct this record: https://phishdestroy.io/appeals/ - Methodology and help: https://phishdestroy.io/faq ## Stored PhishDestroy analysis Overview PhishDestroy lists zoomservice.com.cn as a suspicious domain in its internal blocklist. The domain was first seen by PhishDestroy on 2026-10-20 and the recorded page title advertises a Zoom meeting service client download and waiting‑room features. How the scam works Because the domain is flagged without a concrete activity profile, it could be employed in typical phishing or brand‑impersonation campaigns where attackers host pages that mimic legitimate services to lure credentials or install malware. The page title suggests an attempt to appear as an official Zoom service, which is a common tactic in credential‑harvesting schemes. Evidence VirusTotal scanned the domain on 2026-10-18 using 92 engines and reported zero detections. Google Safe Browsing checked the URL on 2026-10-20 and did not flag it. External blocklists MetaMask and SEAL each listed the domain as of 2026-10-20, giving a total of two external listings. OTX recorded three pulses referencing the domain on 2026-10-20. PhishDestroy’s internal blocklist also includes the domain, confirmed on 2026-10-20. Infrastructure The only observed infrastructure detail is the recorded IP address 154.23.201.94 associated with the domain at the time of analysis. No registrar, CDN or certificate data were provided, so the listing applies solely to this address without identifying the operator. What to do Visitors should not enter Zoom credentials or download files from the site; if any credentials were entered, change them immediately. Security teams should add zoomservice.com.cn to blocklists and monitor network logs for connections to 154.23.201.94. Useful links urlscan.io scan and screenshot: https://urlscan.io/result/01a1597c-6922-701e-9719-e7fa33dc701b/ VirusTotal report: https://www.virustotal.com/gui/domain/zoomservice.com.cn Google Safe Browsing status: https://transparencyreport.google.com/safe-browsing/search?url=zoomservice.com.cn Report phishing to Google: https://safebrowsing.google.com/safebrowsing/report_phish/ Site owner? Request a review: https://phishdestroy.io/appeals/ Analysis generated: 2026-10-20 14:11:02 UTC ## Stored page captures - Primary capture: https://i.ibb.co/N2kkvbbT/c26e82e54e94.png Captured: 2026-10-20 13:26:14 UTC - URLScan capture: https://screenshots.phishdestroy.io/01a1597c-6922-701e-9719-e7fa33dc701b.png Captured: 2026-10-20 13:26:14 UTC Source report: https://urlscan.io/result/01a1597c-6922-701e-9719-e7fa33dc701b/ - Cloudflare Radar: https://screenshots.phishdestroy.io/cf/d04cf6e7-85e9-4ecf-aa1d-2b48adcd2564.png Captured: 2026-10-20 14:04:12 UTC Source report: https://radar.cloudflare.com/scan/d04cf6e7-85e9-4ecf-aa1d-2b48adcd2564 SHA-256: bd69cafb61c53b68f119b3976cbbb7ee8f1bfd422eea3a5e1974021e8d052677 - URLQuery: https://screenshots.phishdestroy.io/uq/99a91826-45f3-4cc6-a67f-1f37eb553f3f.png Source report: https://urlquery.net/report/99a91826-45f3-4cc6-a67f-1f37eb553f3f SHA-256: 3e5b0f3e0fdd13dfdc0e62c3f98a6f9c16f29b6a00650be3d30061e9b0594ae6 - URLScan · 2026-10-20: https://screenshots.phishdestroy.io/us/01a15987-a173-76c4-8a53-d9cb257a85fa.png Captured: 2026-10-20 13:37:11 UTC Source report: https://urlscan.io/result/01a15987-a173-76c4-8a53-d9cb257a85fa/ SHA-256: 9b99c49e859ede03172942cfb132cd4fe522d3cf83be3ed4f30b66564f41188e ## Collected source observations Provider observations retain their own timestamps. Capture links do not establish image content. Shared infrastructure does not identify an operator. ```json { "urlscan": { "v": 1, "fetched_at": "2026-10-20T16:42:21Z", "uuid": "01a1597c-6922-701e-9719-e7fa33dc701b", "scanned_at": "2026-10-20T13:24:55Z", "final_url": "https://zoomservice.com.cn/", "status": 200, "redirected": "https-only", "redirects": [ { "to": "https://zoomservice.com.cn/", "from": "http://zoomservice.com.cn/", "status": 307 } ], "ip": "154.23.201.94", "domains": [ "game-houtai9.com.cn", "collect-v6.51.la", "sdk.51.la" ], "ips": [ "43.159.107.113", "45.202.8.44", "117.187.133.32", "154.23.201.94" ], "asns": [ "139341", "54801", "138407", "8796" ], "countries": [ "SG", "SC", "CN", "US" ], "link_domains": [ "www.mxh4h.com" ], "doc_hash": "2371ba897f4058a6bd4314aca134dc2afb37390a300399cfa375bcd418809129", "script_hashes": [ "0af4f2c287a92fb7811b73683cccf0cd30e49ab769ce0c5e472419811827c46d" ], "globals": [ "LA", "laWaitTime" ], "cookies": [ "__vtins__3RDqOaSopByCSK9V", "__51uvsct__3RDqOaSopByCSK9V", "__51vcke__3RDqOaSopByCSK9V", "__51vuft__3RDqOaSopByCSK9V" ], "storage_keys": [ "dl_link_cache_zoomservice.com.cn" ], "tls": { "san": [ "www.zoomservice.com.cn", "zoomservice.com.cn" ], "cipher": "AES_256_GCM", "issuer": "YR1", "subject": "zoomservice.com.cn", "protocol": "TLS 1.3", "valid_to": "2027-01-15T22:46:07Z", "valid_from": "2026-10-17T22:46:08Z" }, "domain_age_days": 0, "apex_age_days": 0, "tls_age_days": 2, "tls_valid_days": 89, "requests": 8, "verdicts": { "engines": { "tags": [ "urlscan-ml", "urlscan-ml-60c5e22" ], "score": 91, "malicious": true }, "overall": { "tags": [ "phishing" ], "score": 100, "brands": [ "zoom" ], "malicious": true, "categories": [ "phishing" ] }, "urlscan": { "tags": [ "phishing" ], "score": 100, "brands": [ "Zoom" ], "malicious": true, "categories": [ "phishing" ] } }, "headers": { "server": "nginx", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } }, "cf": { "v": 1, "fetched_at": "2026-10-20T17:54:54Z", "uuid": "d04cf6e7-85e9-4ecf-aa1d-2b48adcd2564", "scanned_at": "2026-10-20T14:04:12Z", "final_url": "https://zoomservice.com.cn/", "status": 200, "history": [ { "url": "https://zoomservice.com.cn/", "status": 200 } ], "dom_hash": "f4d7a7c8a88bb5d61acf972f36e0e919b6bab7ba0c73f58d94c7d36c68e29952", "doc_hash": "2371ba897f4058a6bd4314aca134dc2afb37390a300399cfa375bcd418809129", "domain_risks": [ "Newly Seen Domains", "Security Risks" ], "radar_rank": { "bucket": ">200000" }, "dns": [ { "name": "zoomservice.com.cn", "type": "A", "value": "154.23.201.94" } ], "dnssec_valid": false, "ip": "154.23.201.94", "whois": { "registrar": "北京新网数码信息技术有限公司", "created": "2026-10-17T20:37:42Z", "expires": "2027-10-17T20:37:42Z", "nameservers": [ "ns1.363.hk", "ns2.363.hk" ] } }, "vt": { "v": 1, "fetched_at": "2026-10-20T18:04:49Z", "analysis_at": "2026-10-20T14:24:00Z", "stats": { "timeout": 0, "harmless": 54, "malicious": 2, "suspicious": 2, "undetected": 34 }, "detections": { "SOCRadar": "suspicious", "Kaspersky": "phishing", "Gridinsoft": "suspicious", "Forcepoint ThreatSeeker": "phishing" }, "reputation": 0, "categories": { "Google": "technology" }, "first_seen": "2026-10-17T23:48:23Z", "dns": [ { "ttl": 900, "type": "A", "value": "154.23.201.94" }, { "ttl": 3600, "type": "NS", "value": "ns1.myhostadmin.net" }, { "ttl": 3600, "type": "NS", "value": "ns2.myhostadmin.net" }, { "ttl": 500, "type": "SOA", "rname": "dnsconct.myhostadmin.net", "value": "ns1.myhostadmin.net" } ], "dns_at": "2026-10-20T14:29:25Z", "jarm": "3fd3fd0003fd3fd00042d42d0000002059a3b916699461c5923779b77cf06b", "cert": { "san": [ "www.zoomservice.com.cn", "zoomservice.com.cn" ], "issuer": "Let's Encrypt / YR1", "serial": "60b5a1f9b6219b41facd7f7aa8bfe5c74e8", "sha256": "436003d720d743d614483be615158b4dc138203d7a9c7e3f10d814fb5a43e912", "subject": "zoomservice.com.cn", "valid_to": "2027-01-15T22:46:07Z", "valid_from": "2026-10-17T22:46:08Z" }, "whois": { "status": [ "ok" ], "nameservers": [ "ns1.363.hk", "ns2.363.hk" ], "dnssec": "unsigned" } }, "webcheck": { "v": 1, "fetched_at": "2026-10-21T07:58:21Z", "mail_config": { "spf_lookups": 0 }, "caa_records": { "domain": "zoomservice.com.cn" }, "block_lists": { "resolvers": 12, "blocked_count": 0 }, "archives": { "last": "2026-10-20T13:30:11Z", "first": "2026-10-20T13:30:11Z", "changes": 0, "days_archived": 1, "avg_page_bytes": 13082 }, "robots_txt": { "agents": [ "*" ], "present": true, "sitemaps": [ "https://zoomservice.com.cn/sitemap.xml" ] }, "sitemap": { "present": true, "url_count": 2 }, "social_tags": { "ogUrl": "https://zoomservice.com.cn/", "title": "Zoom会议服务台 - Zoom会议客户端领取与下载|等候室、分组讨论与云端留档", "ogType": "website", "robots": "index,follow,max-image-preview:large,max-snippet:-1,max-video-preview:-1", "ogImage": "https://zoomservice.com.cn/logo.png", "ogTitle": "Zoom会议共享与录制服务", "keywords": "Zoom会议服务,等候室,分组讨论,云端录制,共享屏幕权限,联席主持人,会议留档,主持人权限,入会密码,字幕转写,录制布局,联席限额", "ogSiteName": "Zoom会议服务台", "description": "一场会从等候室开始，到云端留档结束。中间涉及共享、录制、分组讨论三项服务，各自有独立的开关和权限。本页说明这三项在哪个位置开、对谁能用、留档留多久，以及主持人与联席主持人的权限差别。权限分账号层、会议层、会中层三级叠加，三层都过，参会者看到的操作才是最终结果。", "twitterCard": "summary_large_image", "canonicalUrl": "https://zoomservice.com.cn/index.html", "ogDescription": "等候室、共享、录制、分组讨论四项服务的开关位置与权限范围。" }, "trackers": { "requests": 4, "trackers": [ { "name": "51.La", "company": "51.La", "category": "Site Analytics", "requests": 1 } ] }, "mixed_content": { "third_party_scripts": 0 }, "status": { "up": true, "code": 200, "timings": { "dns": 350, "tls": 167, "wait": 326, "connect": 163, "download": 164 }, "response_ms": 1170 }, "tls_connection": { "alpn": "h2", "cipher": "TLS_AES_256_GCM_SHA384", "protocol": "TLSv1.3", "versions": [ "TLSv1.2", "TLSv1.3" ], "authorized": true, "forward_secrecy": true }, "ports": { "open": [ 80 ] }, "carbon": { "bytes": 44007, "co2_grams": 0.0016, "cleaner_than": 40 }, "dns_server": { "ns": [ { "ip": "211.149.230.100", "host": "ns2.myhostadmin.net" }, { "ip": "118.123.253.132", "host": "ns1.myhostadmin.net" } ], "zone": "zoomservice.com.cn" }, "cookies": { "cookies": [ { "name": "__vtins__3RDqOaSopByCSK9V", "session": true }, { "name": "__51uvsct__3RDqOaSopByCSK9V" }, { "name": "__51vcke__3RDqOaSopByCSK9V" }, { "name": "__51vuft__3RDqOaSopByCSK9V" } ] }, "location": { "ip": "154.23.201.94", "asn": "8796", "org": "Starcloud Global Pte. LTD", "city": "Rancho Cucamonga", "country": "US" }, "ssl": { "issuer": "Let's Encrypt / YR1", "subject": "zoomservice.com.cn" }, "dns": { "A": [ "154.23.201.94" ], "NS": [ "ns2.myhostadmin.net", "ns1.myhostadmin.net" ], "SOA": "{\"nsname\": \"ns1.myhostadmin.net\", \"hostmaster\": \"dnsconct.myhostadmin.net\", \"serial\": 2026101803, \"refresh\": 43200, \"retry\": 300, \"expire\": 1209600, \"minttl\": 3600}" }, "dnssec": { "ds": false, "rrsig": false, "dnskey": false }, "hsts": { "header": "max-age=31536000", "message": "HSTS header does not include all subdomains." }, "http_security": { "xFrameOptions": false, "referrerPolicy": false, "xXSSProtection": false, "permissionsPolicy": false, "xContentTypeOptions": false, "contentSecurityPolicy": false, "strictTransportPolicy": "max-age=31536000", "crossOriginOpenerPolicy": false, "crossOriginEmbedderPolicy": false, "crossOriginResourcePolicy": false }, "get_ip": { "ip": "154.23.201.94", "family": 4 }, "redirects": { "chain": [ "https://zoomservice.com.cn" ] }, "tech_stack": { "technologies": [ "Nginx", "51.LA", "HSTS", "Open Graph", "HTTP/3" ] }, "linked_pages": { "internal_count": 9 }, "whois": { "registrar": "北京新网数码信息技术有限公司", "created": "2026-10-17T18:37:42Z", "expires": "2027-10-17T18:37:42Z", "status": [ "ok" ], "nameservers": [ "ns1.363.hk", "ns2.363.hk" ] }, "headers": { "headers": { "server": "nginx", "content-type": "text/html", "strict-transport-security": "max-age=31536000" } } } } ```