zoom[.]ceo

The domain zoom.ceo, designed to impersonate the popular video conferencing platform Zoom, has been flagged by 1 out of 95 vendors on VirusTotal. Although the site is currently offline, it is listed on three public blocklists, including PhishDestroy, MetaMask, and SEAL. This suggests a coordinated effort to prevent further exploitation.

Registered through Porkbun, LLC, and hosted on an IP managed by Cloudflare in Canada, zoom.ceo's infrastructure points to a sophisticated setup. The domain's SSL certificate was issued by Let's Encrypt, a common choice for phishing sites due to its ease of use and cost-free nature. The domain was created on May 21, 2026, and PhishDestroy detected it just two days later, highlighting the rapid response capabilities of our threat-intelligence systems.

Despite its takedown, zoom.ceo's presence on multiple blocklists indicates it posed a significant threat during its short-lived operation. The platform risk score of 63 out of 100 further underscores the potential impact it could have had on unsuspecting users. By mimicking Zoom, the domain likely aimed to harvest sensitive information from users who believed they were accessing the legitimate service. This case exemplifies the ongoing need for vigilance in monitoring and responding to emerging phishing threats.