zoom-a[.]com[.]cn

PhishDestroy identifies zoom-a.com.cn as an active cryptocurrency drainer phishing domain that lures victims into connecting their wallets to a fraudulent interface. The domain mimics legitimate Zoom services in an attempt to harvest private keys and drain funds from unsuspecting users. Technical analysis indicates this site is part of a broader campaign targeting crypto holders through fake login portals and fraudulent Zoom meeting invitations. Users should treat any communication from or about this domain as malicious and avoid interaction entirely. This domain was flagged under seed 2222c3 and exhibits multiple red flags including a Let's Encrypt SSL certificate, zero detections on VirusTotal (8/95), a recent creation date of May 15, 2026, and hosting on IP address 38.91.116.179. The domain is registered through Web Commerce Communications Limited (Webnic), which has been associated with numerous malicious registrations. While currently undetected by antivirus engines, its recent creation and suspicious infrastructure warrant immediate caution. The complete lack of detection combined with active hosting suggests this campaign is in its early deployment phase. If you have visited zoom-a.com.cn or entered any information on the site, disconnect your wallet immediately and revoke any connected permissions. Scan your device for malware using PhishDestroy's threat removal tools and consider rotating all wallet credentials. Do not interact with any further communications from this domain or similar-looking URLs. Report the domain to PhishDestroy and your local cybercrime unit to help disrupt this campaign. Always verify links through PhishDestroy's verification service before clicking, especially those claiming to be from Zoom or other financial services.