zoom-prem1um[.]my[.]id

This domain, zoom-prem1um.my.id, is actively engaged in credential harvesting phishing operations designed to deceive users into disclosing login credentials for video conferencing platforms. The site mimics legitimate premium service offerings, presenting itself under the title 'ZOOM PREMIUM' to exploit trust in widely used communication tools. The primary threat involves the unauthorized capture of user credentials, which may subsequently be used for unauthorized access, account takeovers, or further malicious activities such as business email compromise or lateral movement within compromised networks.

Analysis indicates this domain was registered on May 19, 2026, through PT Digital Registra Indonesia, and currently resolves to the IP address 203.175.8.173, hosted in Indonesia by CV. Rumahweb Indonesia. The domain is flagged by 1 out of 95 security vendors on VirusTotal, and appears on three distinct security blocklists. The SSL certificate is issued by Let's Encrypt (R12), a common practice among phishing operators to lend a false sense of legitimacy. Despite the low detection rate on VirusTotal, the presence on multiple blocklists and the use of a deceptive domain name suggest a targeted and evasive campaign.

Users who have visited zoom-prem1um.my.id or entered credentials on this site should immediately revoke any submitted information by changing passwords for all associated accounts, particularly those linked to video conferencing or enterprise collaboration tools. Enable multi-factor authentication where available to mitigate the risk of unauthorized access. Monitor accounts for suspicious activity, such as unauthorized logins or messages sent from compromised accounts. Network administrators should block the domain and its resolving IP (203.175.8.173) at the perimeter, and consider implementing DNS-based filtering to prevent access. If corporate credentials were exposed, initiate an internal review to assess potential data exposure or unauthorized access within the organization.