zmpromeeting[.]com

Analysis indicates that the domain zmpromeeting.com was registered on 11 November 2025 through NameCheap, Inc. The authoritative nameservers dns1.namecheaphosting.com and dns2.namecheaphosting.com resolve the domain to the IPv4 address 199.188.205.217, which is assigned to AS22612 operated by Namecheap, Inc. and geolocated to the United States. No TLS certificate is presented, meaning the site is served over plain HTTP only. The page title returned from the live endpoint is “Join Meeting”, and the domain is explicitly flagged as impersonating the Zoom brand. The observed scam type is classified as banking phishing, suggesting that the site attempts to harvest credentials or financial information under the guise of a Zoom meeting invitation.

The domain appears on two external blocklists, specifically PhishDestroy and ScamSniffer, both of which have listed it as malicious. VirusTotal scans show that five out of ninety‑five security vendors flagged the domain, reinforcing the malicious assessment. Gridinsoft’s trust scoring system assigns a score of 0 out of 100, indicating a complete lack of trust. The current operational status is offline, which may be the result of takedown actions or the host removing the site.

Defenders should continue to block any DNS resolution to 199.188.205.217 and enforce URL filtering rules that deny access to the domain and its subdomains. Monitoring for newly registered domains that share the same registrar, nameserver pattern, or similar lexical components (e.g., “zoom” or “meeting”) can help detect future impersonation attempts. Because the site is no longer reachable, direct remediation is limited to preventing future connections and updating threat intelligence feeds with the observed indicators.