zoom-app[.]us

The domain zoom-app.us has been identified as a high-risk credential theft phishing site impersonating the Zoom brand. It specifically targets users by presenting a page titled "Join Meeting - Zoom" to lure victims into submitting sensitive login information. There is no evidence of a known drainer kit, but the page is designed to harvest Zoom account credentials through deceptive means.

Technical indicators reveal that zoom-app.us has a VirusTotal detection rate of 1 out of 95 security vendors, indicating limited but significant detection. The domain was registered on April 17, 2026, through Hosting Concepts B.V. d/b/a Registrar.eu. It resolves to IP address 104.21.24.30 and uses a Let's Encrypt SSL certificate to appear legitimate. The domain remains active and is currently not flagged by Google Safe Browsing. It is not widely listed on major blocklists, which increases the risk of victim exposure.

At present, zoom-app.us is still operational and poses a high risk to users attempting to join Zoom meetings. Security measures should include blocking access to this domain at network levels and educating users about verifying official Zoom URLs and SSL certificates. Given the low detection ratio on VirusTotal and the domain's recent creation, vigilance is necessary as it may evade some security tools. Immediate action by cybersecurity teams is recommended to prevent credential compromise and further spread of this phishing threat.