joinzoom-client[.]us

This domain, joinzoom-client.us, is flagged as a credential-harvesting phishing site designed to impersonate Zoom, a widely used video conferencing platform. Analysis indicates the domain mimics legitimate Zoom meeting pages, as evidenced by the page title 'Join Meeting | Zoom,' which aligns with authentic Zoom session initiation pages. No drainer kit signatures were detected in initial scans, though the infrastructure exhibits characteristics typical of phishing campaigns, including the use of Cloudflare and HTTP/3 for obfuscation and performance optimization. Infrastructure analysis reveals the domain was registered on April 28, 2026, through NameSilo, LLC, and resolves to the IP address 188.114.96.3. Despite its recent creation, the domain appears on four security blocklists, including MetaMask and PhishDestroy, suggesting prior detection by specialized threat intelligence feeds. VirusTotal reports 0/95 detections, indicating a lack of broad antivirus coverage at the time of assessment. The domain employs a Let's Encrypt SSL certificate, a common tactic to lend an appearance of legitimacy, and has a Gridinsoft trust score of 0/100, reinforcing its high-risk classification. As of the latest assessment, joinzoom-client.us has been taken offline, likely in response to blocklist inclusion or manual takedown efforts. However, the domain's infrastructure remains registered, posing a residual risk of reactivation or migration to a new host. Users who may have interacted with the domain are advised to reset credentials for any associated accounts, particularly those linked to Zoom or single sign-on services. Organizations should monitor for similar domains leveraging the Zoom brand, particularly those registered through NameSilo with Cloudflare hosting, and update blocklists to include this domain and its resolved IP address.