expertzoomroom[.]com

PhishDestroy identifies expertzoomroom.com as an active credential harvesting domain impersonating the Zoom webinar platform. The domain is currently under investigation for generic phishing activity, with a high-risk status indicating active exploitation. This fake 'expert zoom room' service mimics legitimate Zoom domains to trick users into entering their corporate or personal credentials, potentially exposing sensitive login data to threat actors.

Security analysis reveals this domain presents multiple red flags: it was registered through Dreamscape Networks International Pte Ltd, resolves to IP address 188.114.97.3, and was created on April 28, 2021. Notably, VirusTotal analysis shows 0 detections from 95 security vendors, suggesting this newly active campaign has evaded traditional signature-based detection. The domain employs a valid SSL certificate from Google Trust Services, which may further lower user suspicion. According to threat intelligence sources, this domain has not yet been added to public blocklists, indicating its recent activation.

The current active status requires immediate caution from all users. PhishDestroy strongly recommends blocking access to expertzoomroom.com at the network level and educating users about this specific credential harvesting campaign. Organizations should scan their logs for any authentication attempts to this domain and consider implementing DNS sinkholing. Users who may have entered credentials should immediately change passwords and enable multi-factor authentication on all accounts. This threat demonstrates the increasing sophistication of phishing campaigns that exploit legitimate service impersonation. Seed: 4398c6