zoom-sdk[.]us

This domain, zoom-sdk.us, is flagged as a high-risk crypto drainer phishing site designed to impersonate Zoom's software development kit (SDK) infrastructure. Analysis indicates the domain was likely created to exploit users seeking legitimate Zoom SDK resources, redirecting them to malicious interfaces that drain cryptocurrency wallets. No specific drainer kit has been conclusively identified, but the infrastructure aligns with known crypto-focused phishing campaigns targeting developers and enterprise users.

Technical indicators confirm the domain's malicious classification. VirusTotal detection shows 12 out of 95 security vendors flagging zoom-sdk.us as malicious. The domain was registered on February 21, 2026, through an undisclosed registrar, and resolves to the IP address 103.224.182.15, hosted under AS133618 (Trellian Pty. Limited). The SSL certificate is issued by Let's Encrypt (R13), a common choice for both legitimate and malicious domains. The domain appears on three security blocklists, and no entries were found in Google Safe Browsing at the time of analysis. The page title 'mamma' suggests either a placeholder or a misconfiguration, further indicating low-effort malicious infrastructure.

As of the latest assessment, zoom-sdk.us has been taken offline, likely due to enforcement actions by security providers or hosting interventions. However, the domain remains registered, posing a residual risk if reactivated or repurposed. Users who accessed this domain should assume potential exposure of cryptocurrency wallet credentials or sensitive SDK-related data. Immediate steps include revoking any active sessions, rotating credentials, and monitoring connected wallets for unauthorized transactions. Organizations should block the domain and IP at the network level to prevent accidental access in case of reactivation.