zoomrushy[.]com

This domain is flagged for elevated-risk brand impersonation targeting Zoom users through a fraudulent business services portal. Analysis indicates the site was designed to deceive enterprise users by mimicking legitimate Zoom offerings, specifically presenting itself as 'Servicios Business' to harvest credentials or distribute malicious payloads. Infrastructure analysis reveals the domain was registered on October 13, 2023, through OVH, SAS and resolved to IP address 188.165.132.144. Technical indicators include a Let's Encrypt SSL certificate, Bootstrap framework usage, and a page title of 'Servicios Business.' Detection metrics show 1 of 95 security vendors on VirusTotal flagged the domain, while Gridinsoft assigned a trust score of 0/100. The domain appears on one security blocklist and was specifically blocked by PhishDestroy. Mitigation for this threat type requires multi-layered defenses. Network-level protections should block the domain and its associated IP (188.165.132.144) at firewalls and DNS resolvers. Endpoint security should monitor for connections to newly registered domains (NRDs) created within the last 90 days, particularly those using Let's Encrypt certificates with business-related page titles. User awareness training should emphasize verifying domain names before entering credentials, especially for 'business services' portals claiming to be from major communication platforms. Security teams should implement DMARC, DKIM, and SPF policies to prevent similar brand impersonation attempts via email.