zoom-app[.]store

PhishDestroy identifies zoom-app.store as an active phishing domain posing as a Zoom application storefront. The site is classified under the threat type 'generic_phishing' with a current risk level marked as 'under_investigation'. This classification indicates the domain is likely deployed to deceive users into downloading malicious software or surrendering sensitive credentials under the guise of legitimate Zoom services.

This domain resolves to the IP address 208.91.198.233 and operates with an SSL certificate issued by Let's Encrypt, which may lend it an air of legitimacy to unsuspecting visitors. Notably, VirusTotal currently shows 0 detections out of 95 security engines, suggesting it has not yet been widely flagged by antivirus or threat intelligence platforms. The domain's infrastructure and SSL certificate indicate an attempt to appear trustworthy, but the absence of detections should not be interpreted as safety. The domain's operational status and the lack of detections underscore the importance of proactive verification by users and security teams.

Mitigation for this specific phishing threat involves several critical steps. Users should immediately cease any interaction with zoom-app.store, including avoiding downloads or credential submissions. Organizations should block the domain at the network perimeter and inspect endpoints for signs of compromise. Security teams should monitor for connections to the IP address 208.91.198.233 and update threat intelligence feeds to include this domain. Additionally, users should verify the authenticity of any Zoom-related websites by cross-referencing with official sources, such as Zoom's verified domains or direct links from trusted communications. Proactive user education on identifying phishing tactics, such as mismatched URLs or unsolicited download prompts, is essential to prevent credential theft or malware infections. c19269