zoommcall[.]com

This domain, zoommcall.com, was identified as a high-risk phishing site designed to impersonate legitimate video conferencing platforms. Analysis indicates the domain was specifically crafted to harvest login credentials by presenting fraudulent login portals mimicking corporate remote meeting tools. The threat primarily targets users attempting to join virtual meetings, redirecting them to malicious interfaces that capture entered credentials for subsequent unauthorized access or lateral movement within corporate networks.

Infrastructure analysis reveals the domain was registered on April 26, 2026, through OwnRegistrar, Inc., and resolves to the IP address 91.202.233.170, hosted by Prospero OOO in Turkmenistan. The domain appears on three security blocklists and is flagged by 20 out of 95 security vendors on VirusTotal, with detections including phishing, fraudulent login, and brand impersonation. The SSL certificate, issued by Let's Encrypt (R13), does not mitigate the risk, as the domain's infrastructure and registration patterns align with known phishing campaigns.

Users who visited zoommcall.com should immediately revoke any entered credentials, particularly those associated with corporate or personal accounts. System administrators are advised to block the domain and its resolving IP (91.202.233.170) at the network level. Affected users should conduct a full password reset for all accounts accessed from the same device or network segment during the exposure window. Additionally, monitor for unauthorized activity, as harvested credentials may be leveraged for further attacks, including account takeovers or internal phishing attempts.