zoom-meets[.]org

This domain is flagged as a high-risk darknet marketplace impersonation site designed to deceive cryptocurrency users. Analysis indicates the infrastructure is actively facilitating fraudulent transactions under the guise of a privacy-focused platform, with the page title explicitly displaying 'NULLMARKET — Privacy-First Marketplace.' The specific threat type involves cryptocurrency theft, likely through wallet drainers or fraudulent escrow schemes, rather than generic credential harvesting. Infrastructure analysis reveals the domain was registered on May 24, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu, an uncommon future date suggesting potential WHOIS manipulation. The site resolves to IP address 188.114.97.3 and employs an SSL certificate issued by Google Trust Services (WE1), which may lend false legitimacy. Detection metrics show 1/95 security vendors on VirusTotal flagging the domain, while three independent blocklists—PhishDestroy, MetaMask, and SEAL—have already classified it as malicious. The domain remains operational at the time of assessment, increasing exposure risk. Mitigation requires immediate action from security teams and end users. Network administrators should block the domain and associated IP (188.114.97.3) at the perimeter level, while cryptocurrency wallet providers should integrate the domain into transaction verification denylists. End users must verify marketplace URLs through official sources and avoid connecting wallets to unverified platforms. Given the future-dated registration, analysts should monitor for additional domains using similar WHOIS obfuscation tactics. Cryptocurrency transactions initiated from this domain should be treated as fraudulent and reported to relevant blockchain analysis platforms.