zoomlnfo[.]us

Analysis of zoomlnfo.us indicates an active brand‑impersonation campaign targeting Zoom users. The domain presents a valid Let's Encrypt certificate (YR2) and returns HTTP status code 202, suggesting a functional web service. Infrastructure traces show the domain resolves to 35.215.88.115, a Google Cloud instance in the us‑west2 region of the United States. Email routing uses mx10.antispam.mailspamprotection.com (priority 10); additional MX records are not disclosed, leaving the full mail handling configuration uncertain. Threat intelligence flags the site on three public blocklists and confirms it is blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal reports 12 of 91 scanners flagging the domain, reinforcing its malicious reputation. Defenders should proactively block zoomlnfo.us at perimeter and DNS layers, monitor outbound traffic for connections to the identified IP, and enforce strict email filtering for messages that may originate from the listed MX host. Continuous re‑evaluation is advised as further payload or page content analysis becomes available.