zm-zoom[.]com[.]cn

Analysis indicates that the domain zm-zoom.com.cn was registered on February 21, 2026 through Web Commerce Communications Limited. The domain resolves to IP 154.195.66.111, which belongs to AS9294 GNET INC. in Hong Kong. No TLS certificate is presented; HTTP connections are unencrypted and the site is currently taken offline. The page title observed before takedown reads “高效视频会议选 Zoom 专业协作办公软件”, which references Zoom but the threat intelligence tags the site as impersonating Google.

This inconsistency suggests a possible attempt to lure victims by mixing brand references. The domain appears on three public blocklists and is specifically flagged by PhishDestroy, MetaMask, and SEAL. VirusTotal scans show that six of ninety‑three security vendors submitted a detection for the domain, reinforcing its malicious classification. The nameservers listed are a.share-dns.com, a8.share-dns.com, b.share-dns.net, and b8.share-dns.net, a pattern observed in other malicious infrastructure. Gridinsoft assigns a trust score of zero out of one hundred, indicating no confidence in the site's legitimacy.

Given the lack of an SSL certificate, the offline status, and the limited publicly available content, the precise phishing workflow cannot be fully reconstructed. However, the combination of brand impersonation, low trust score, blocklist presence, and partial VirusTotal detections provides sufficient evidence for defensive action. Organizations should add zm-zoom.com.cn to web‑filter deny lists, ensure DNS resolvers block queries to the associated IP, and monitor for any new domains sharing the same registrar or naming‑server pattern. Security telemetry should also be tuned to flag any HTTP traffic to the domain or attempts to resolve it, as threat actors may reactivate the site or deploy a clone. Continuous review of blocklist updates and VirusTotal re‑scans is recommended to capture any changes in the domain's status.