zoomappdownload[.]net

This domain, zoomappdownload.net, is flagged as a brand impersonation threat targeting MetaMask, a cryptocurrency wallet service. Analysis indicates the domain was designed to deceive users into entering sensitive credentials, likely through a fake wallet interface or phishing page. The threat type aligns with known cryptocurrency drainer kits, which automate the theft of digital assets once credentials are compromised. Infrastructure analysis reveals the domain was registered on May 20, 2026, through DropCatch.com 1146 LLC, a registrar frequently associated with expiring domain acquisitions. It resolves to the IP address 54.84.240.235, hosted on Amazon Web Services infrastructure, and employs technologies such as Cloudflare, Amazon CloudFront, and Google Analytics for traffic management and tracking. The domain appears on 3 security blocklists and is flagged by 6 out of 95 security vendors on VirusTotal. The page title, DropCatch.com, further suggests a connection to domain drop-catching services, which are often exploited for malicious purposes. Currently, zoomappdownload.net is offline, likely due to takedown actions by MetaMask, PhishDestroy, and SEAL. However, the domain remains registered, posing a residual risk if reactivated. Users who interacted with this domain should immediately revoke any connected wallet permissions, rotate credentials, and monitor accounts for unauthorized transactions. Organizations are advised to update blocklists with this domain and its associated IP to prevent future access attempts.