Lompat ke laporan keamanan
Checked 09/08/2026 Ref 3729D1BD

MALICIOUS — CRITICAL

Pemeriksaan phishing dan keamanan zoom-sdk.us

zoom-sdk[.]us

This domain, zoom-sdk.us, is flagged as a high-risk crypto drainer phishing site designed to impersonate Zoom's software development kit (SDK) infrastructure.

90/100 evidence score · Critical
VirusTotal
12/93
Blocklists
2 · MetaMask, SEAL
Ketersediaan
Konten tidak tersedia · HTTP 502
Report / Add Evidence Appeal this listing
2026-03-27 12:30 UTCKonten tidak tersedia · HTTP 502
View full size Wayback Unduh

Do not enter credentials, seed phrases, payment details, or personal information on this domain.

⚠️
Domain ini telah ditandai sebagai berbahaya
Mesin keamanan melaporkan deteksi: 12. Daftar blokir publik yang melaporkan kecocokan: 2. Berhati-hatilah — jangan memasukkan kredensial atau informasi pribadi.
Jump to section
Ringkasan laporan

zoom-sdk.us — Konten tidak tersedia (HTTP 502). Peniruan identitas merek: Gmail. Ringkasan bukti: VirusTotal 12/93 (ADMINUSLabs, alphaMountain.ai, CyRadar, ESET, ESTsecurity); 2 external blocklist matches (MetaMask, SEAL); PhishDestroy score 90/100.

Analisis terperinci PhishDestroy AI di bawah tetap berbahasa Inggris untuk menjaga catatan forensik asli.

Evidence Analysis

Stored AI analysis · 26/06/2026

Ref 3729D1BD

This domain, zoom-sdk.us, is flagged as a high-risk crypto drainer phishing site designed to impersonate Zoom's software development kit (SDK) infrastructure. Analysis indicates the domain was likely created to exploit users seeking legitimate Zoom SDK resources, redirecting them to malicious interfaces that drain cryptocurrency wallets. No specific drainer kit has been conclusively identified, but the infrastructure aligns with known crypto-focused phishing campaigns targeting developers and enterprise users.

Technical indicators confirm the domain's malicious classification. VirusTotal detection shows 12 out of 95 security vendors flagging zoom-sdk.us as malicious. The domain was registered on February 21, 2026, through an undisclosed registrar, and resolves to the IP address 103.224.182.15, hosted under AS133618 (Trellian Pty. Limited). The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The domain appears on three security blocklists, and no entries were found in Google Safe Browsing at the time of analysis. The page title 'mamma' suggests either a placeholder or a misconfiguration, further indicating low-effort malicious infrastructure.

As of the latest assessment, zoom-sdk.us has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, the domain remains registered, posing a residual risk if reactivated or repurposed. Users who accessed this domain should assume potential exposure of cryptocurrency wallet credentials or sensitive SDK-related data. Immediate steps include revoking any active sessions, rotating credentials, and monitoring connected wallets for unauthorized transactions. Organizations should block the domain and IP at the network level to prevent accidental access in case of reactivation.

Stored source results

Recorded verdicts and infrastructure observations for this domain.

VirusTotal
VirusTotal
12 det.
OTX references
5 community refs
DNS Security
7/14
URLScan
URLScan
Laporan ↗
Sertifikat TLS
Kedaluwarsa atau belum diverifikasi -75d
Usia
6 mo
Status terpantau
Konten tidak tersedia 502
PhishDestroy
Daftar Hapus
Terdaftar
Cakupan data12 recorded checks
VirusTotal 12 / 93 URLQuery source data unavailable PhishStats tidak diperiksa OTX 5 community references CF Radar scan completed URLScan capture laporan yang disimpan URLScan verdict putusan tidak tersedia Pemblokiran DNS 7/14 TLS Kedaluwarsa atau belum diverifikasi WHOIS 6 mo old Tangkapan layar 2 captures · 2 sources Rantai pengalihan tidak diselidiki
Intelijen Keamanan Jaringan
DNS Provider Blocks 7 / 14
Brand Zoom Cloudflare Family Cloudflare Security Controld Adblock Controld Family Controld Malware Quad9 Secure
Dangerous · Checked 14 DNS providers: Quad9, AdGuard, ControlD, CleanBrowsing & more

Alur Tanggapan Ancaman Pipeline

Penemuan
Checks
Reports
Ketersediaan
15/16
Ancaman Telah Diterima
zoom-sdk.us telah terdeteksi dan dimasukkan ke dalam antrian untuk analisis menyeluruh
26/02/2026
URLScan.io Capture
Stored URLScan report with capture artifacts
27/03/2026
Cloudflare Radar Report
A stored Cloudflare Radar report is available. The report link alone is not a malicious verdict and does not prove that every network field was captured.
VirusTotal
12/93 recorded on VirusTotal
25/02/2026
Google Safe Browsing
02/03/2026
Deteksi Daftar Blokir
Ditemukan di 2 blocklists: MetaMask, SEAL
09/08/2026
OTX Community References
5 community publication references on AlienVault OTX. References are not vendor verdicts and are excluded from the evidence score.
01/03/2026
DNS Security Blocks
Blocked by 7 of 14 checked DNS providers: Brand zoom, Cloudflare family, Cloudflare security, Controld adblock
Brand Impersonation
Impersonation of Gmail
Forensic Evidence Collected
Stored evidence from URLScan.io, URLQuery, stored screenshot
27/03/2026
Technical Analysis Recorded
Laporan tersebut berisi teknologi tersimpan atau hasil analisis forensik.
09/08/2026
Cloudflare Radar Scan
Dipindai dengan Cloudflare Radar; analisis jaringan selesai.
02/03/2026
Complaint Draft Available
Tidak ada penyerahan yang dicatat. Anda dapat membuat draf, meninjaunya, dan menyerahkannya sendiri ke otoritas yang sesuai.
Daftar yang Dihapus Telah Dipublikasikan
26/02/2026
Content Observed Unavailable
Pemeriksaan terakhir yang disimpan menunjukkan bahwa konten yang dilaporkan tidak tersedia; ini tidak menentukan siapa atau apa yang menyebabkan perubahan tersebut.
15/03/2026
Waktu hingga pertama kali tidak tersedia
3169 jam berlalu dari deteksi hingga observasi pertama yang tidak tersedia.

Status Daftar Blokir Publik

Tangkapan tersimpan

Primary capture 1 / 2
Lihat Ukuran Penuh Wayback Unduh

Intelijen Domain

Domain
Server / ASN Apache · AS133618 TRELLIAN-AS-AP Trellian Pty. Limited, AU
Reputasi IP abuse score 0/100 1 report checked 15/06/2026
Alamat IP 103.224.182.15 US
LokasiUS San Diego, US
JaringanAS133618 · Trellian Pty. Limited
IP terbalikviewdns.info → rapiddns.io →
PendaftaranDibuat 21/02/2026 (169d)
Status HTTP502 Error
Waktu hingga pertama kali tidak tersedia 132 days
Yang kami hitung Waktu yang berlalu sejak laporan penyalahgunaan pertama kali disimpan hingga pengamatan pertama bahwa konten tersebut tidak tersedia. Hal ini tidak dapat menentukan penyebabnya.
Isi setiap laporan Catatan laporan keluar yang disimpan dapat merujuk pada bukti yang tersedia pada saat itu, seperti keputusan vendor, data pendaftaran, detail hosting, klasifikasi, atau tangkapan layar. Halaman ini tidak menyimpulkan secara pasti muatan yang dikirimkan, penerimaan, pengakuan, atau tindakan oleh penerima.
Rincian teknisDNS, SAN SSL, cap waktu
Pertama Kali Terdeteksi26/02/2026
DOM Analysisanalyzed 29/07/2026score 90/1009 brand signals
IoC Extractionscanned 02/08/20260 wallet · 0 Telegram IoCs
Server namans2.abovedomains.com
TLS Fingerprint
TLS Observationvalid from 25/02/2026scanned 15/03/2026
TLS SAN Domainsbrisamavcwqgica.it.comclzusa.orgfdfxmyhced.bizflabizlaw.comfuygzx.directoryhcc7.cchotlilteens.comipfwe.academyipxtremepro.comirlzi.orgjeoantgroupnj2dr.topkdq2366.ccmachupicchu55getaway496851.icumagget.commemre.co.za+28
Judul Halaman
mamma
Impersonates
Gmail Google Icloud Microsoft Outlook Revolut Yahoo YouTube +1
Sertifikat TLS
Kedaluwarsa atau belum diverifikasi · Diterbitkan oleh Let's Encrypt / R13
Teknologi · 6 identified
PHP
Programming languages

Server-side scripting language designed for web development.

Apache HTTP Server
Web servers

Most widely used open-source HTTP server software.

jQuery UI

Legacy JavaScript library — DOM manipulation and AJAX helpers. Still widely present on older sites.

J
jQuery CDN

Legacy JavaScript library — DOM manipulation and AJAX helpers. Still widely present on older sites.

jQuery
JavaScript libraries

Fast, small JavaScript library simplifying HTML manipulation, event handling, and Ajax.

Contentsquare
Detected via Cloudflare Radar · Wappalyzer engine
Laporkan Domain Ini Kirimkan bukti & bantu lindungi orang lain

Analisis VirusTotal

12 / Vendor keamanan 93 menandai domain ini
View on VT
Last analyzed
ADMINUSLabs
alphaMountain.ai
CyRadar
ESET
ESTsecurity
Fortinet
Lionic
PhishFort
Seclookup
SOCRadar
Sophos
Webroot
Analisis Performa Situs

Google PageSpeed Insights — mobile performance audit of zoom-sdk.us · checked Mar 2, 2026

46
Poor
Performance
FCP
2.97s
First Contentful Paint
LCP
17.32s
Largest Contentful Paint
CLS
0
Cumulative Layout Shift
TBT
656ms
Total Blocking Time
SI
8.13s
Speed Index
Powered by Google PageSpeed Insights · Mobile strategy · Scores: 90-100 Good 50-89 Needs Work 0-49 Poor
Bukti & Laporan EksternalIndependent lookups and source reports
Analisis Keamanan
URLScan Stored capture VirusTotal 12 det. ChainPatrol URLQuery Data unavailable Gridinsoft SSL Laboratorium Expired/unverified CF Radar Open report DNS Security 7/14 OTX 5 refs WOT ScamAdviser Pemeriksa Daftar Hitam URLVoid Sucuri SiteCheck Observatorium MDN
OSINT & Intelijen
Web-Check Full scan SOCRadar Dark web report LeakIX Leak search Shodan Censys ThreatFox Batu Hudson Sign-in search IntelX crt.sh Sertifikat WHOIS Wayback
DNS & Jaringan
nslookup.io DNS bgp.tools ASN /Rute
SEO & Domain
SpyFu Moz DA/PA Ahrefs Tautan balik Analisis Mendalam
Victim safety and official reportingImmediate actions and verified reporting channels
If credentials were compromised, report immediately. Do not engage with recovery scammers.

Jika Anda memasukkan kredensial akun, informasi pribadi atau pembayaran, atau mengunduh file dari domain ini, segera ambil tindakan. Di bawah ini adalah sumber daya untuk membantu Anda melaporkan insiden tersebut dan melindungi diri Anda sendiri.

Europol
Temukan saluran pelaporan resmi untuk negara UE Anda
National police directory
PhishDestroy listing review Bukan laporan penegakan hukum
Banding atas Nama Domain
Minta peninjauan jika Anda pemilik domain ini dan yakin cantumannya salah
Waspadalah terhadap penipu yang mengatasnamakan pemulihan! Penjahat dapat menghubungi korban lagi sambil berpura-pura menjadi penyelidik, pengacara, atau agen pemulihan. Jangan membayar biaya di muka atau membagikan kredensial. Pelajari lebih lanjut tentang penipuan dalam proses pemulihan →

Laporkan kepada Pihak Berwenang di Daerah Anda

Pilih negara Anda untuk mendapatkan kontak resmi kejahatan dunia maya, atau membuat draf pengaduan →.

Direktori 97 negara
Draf yang dibantu AI — detail insiden diproses oleh penyedia AI Tinjau dan kirimkan sendiri
Sematkan Laporan IniRead-only HTML widget
HTML · IFRAME

Sematkan Laporan Ini

Bagikan informasi ancaman ini di situs web atau blog Anda

embed.html 
<iframe
  src="https://phishdestroy.io/id/embed/domain/zoom-sdk.us"
  title="PhishDestroy threat report for zoom-sdk.us"
  width="100%" height="320"
  loading="lazy"
  referrerpolicy="no-referrer"
  sandbox="allow-same-origin allow-popups allow-popups-to-escape-sandbox"
  style="border:0;border-radius:12px;max-width:100%"
></iframe>