emansaridin[.]live

Analysis of the domain emansaridin.live indicates an active credential phishing campaign targeting Zoom users. The domain was registered on March 28, 2026, through GoDaddy.com, LLC, and currently resolves to the IP address 15.197.225.128, which is associated with AWS Global Accelerator infrastructure located in Canada. The domain employs a 301 HTTP redirect, a common technique used to obscure the final phishing destination or to evade detection during automated scans. The page title, 'Join from Zoom Workplace app - Zoom,' explicitly suggests an attempt to impersonate Zoom's legitimate meeting interface, aligning with the reported scam type of credential phishing. Infrastructure analysis reveals the use of Cloudflare and HTTP/3, technologies often leveraged to enhance performance and evade traditional security measures. The domain's nameservers, ns57.domaincontrol.com and ns58.domaincontrol.com, are consistent with GoDaddy's hosting infrastructure. The SSL certificate, issued by GoDaddy TLS Intermediate CA DV - R1v1, provides a baseline level of encryption but does not validate the legitimacy of the site's content. Detection metrics show that seven of ninety-four security vendors on VirusTotal have flagged this domain as malicious, while Gridinsoft assigns it a trust score of 0/100. The domain appears on one security blocklist and is actively blocked by PhishDestroy. Defenders should prioritize blocking this domain and its associated IP address at the network level. Given the use of Cloudflare and HTTP/3, monitoring for similar domains leveraging these technologies may help identify related phishing infrastructure. The domain's recent registration and low detection rates suggest it may still be in the early stages of deployment, warranting heightened scrutiny. No additional details regarding the phishing kit or specific payload are available at this time.