bing-zoom[.]com[.]cn

On July 24, 2026 the domain bing-zoom.com.cn was observed hosting a malicious page that claims to offer Zoom video‑conference software, as indicated by the HTML title “Zoom 视频会议 高效办公沟通必备软件”. The site explicitly impersonates the Zoom brand, a fact corroborated by the provided brand target field. Registration records show the domain was created on 21 February 2026 and was registered through Web Commerce Communications Limited. The authoritative name servers listed are a12.share-dns.com and b12.share-dns.net, which resolve the domain to the IPv4 address 154.195.66.107. The IP resides in Hong Kong and is announced by AS9294 (GNET INC.).

Network fingerprints reveal the web server is Nginx and the site serves an HSTS header, although no TLS certificate is presented, meaning the connection is unencrypted HTTP. An HTTP GET request returns status code 200, confirming the page is reachable despite the lack of SSL. The malicious activity is classified as banking phishing, suggesting the page attempts to harvest financial credentials. VirusTotal analysis reports that 4 of 93 scanned security vendors flagged the domain, indicating a moderate level of detection. Independent blocklist providers PhishDestroy, MetaMask, and SEAL have already added the domain to their deny lists, and the domain appears on three additional security blocklists.

The current operational status is “offline”, implying the site has been taken down or is no longer serving content. Defenders should update perimeter controls to block any DNS resolution of bing-zoom.com.cn, enforce HTTP to HTTPS redirection policies that would drop unencrypted connections, and add the associated IP address 154.195.66.107 to network‑level deny lists. Email security gateways should incorporate the domain into phishing detection rules, especially given its banking‑phishing profile. Continuous monitoring of the registrar Web Commerce Communications Limited and the underlying hosting AS may reveal future infrastructure reuse.