web04zoom[.]im

The domain web04zoom.im is identified as a credential harvesting phishing infrastructure targeting users through deceptive login interfaces. Analysis indicates the domain is currently offline, though it previously hosted active phishing content designed to capture sensitive authentication details. No direct brand impersonation has been confirmed, but the domain structure suggests an intent to mimic legitimate communication platforms. Infrastructure analysis reveals the domain was registered through an anonymized registrar on February 21, 2026, and has been flagged by 19 of 95 security vendors on VirusTotal. It appears on three distinct security blocklists, including entries from high-confidence threat intelligence sources. The domain's creation date aligns with recent phishing campaign timelines, and its hosting infrastructure was previously linked to a known malicious IP range, though current resolution attempts return no active records. No associated SSL certificates or subdomains have been observed in recent scans. Given the domain's current offline status, immediate risk to end users is reduced, though residual threats may persist through cached or archived content. Organizations are advised to update internal blocklists to include web04zoom.im and monitor for any attempts to re-register or re-host the domain. Network administrators should review logs for prior connections to this domain and implement DNS-based blocking rules to prevent future access. End users who may have interacted with the domain should reset credentials for any accounts accessed during the exposure window and enable multi-factor authentication where available.