zoomzn2[.]top

PhishDestroy has identified zoomzn2.top as a generic phishing domain that impersonates the Zoom brand, attempting to lure users into downloading malicious software under the guise of a legitimate Zoom client. The page title, 'Zoom会议下载_Zoom电脑版官方下载_高清视频会议软件', is designed to deceive users searching for Zoom's official download portal. No specific drainer kit was identified, but the threat involves credential harvesting and potential malware delivery.

Key technical indicators reinforce the malicious nature of this domain. VirusTotal reports that 6 out of 95 security vendors flag the domain as malicious, and it appears on 3 security blocklists. The domain resolves to IP address 202.146.222.59 and was registered through Cosmotown on May 26, 2026, which is an anomalously recent creation date for a domain that is already offline. The SSL certificate was issued by Let's Encrypt, which is commonly abused by phishing sites. No Google Safe Browsing data is available, but the domain's presence on multiple blocklists and vendor detections indicates widespread recognition as a threat.

Currently, zoomzn2.top has been taken offline, which is a positive outcome following detection and potential reporting. However, users should remain vigilant as similar domains may appear. PhishDestroy recommends that users always verify the authenticity of Zoom download pages by visiting the official Zoom website directly, rather than clicking on links from unsolicited sources. If you have already interacted with this domain, run a security scan and change any credentials used on the site. Continued monitoring for derivative domains is advised.