zoomupdate[.]info

Zoomupdate.info was created on May 28, 2026 and is registered through Wild West Domains, LLC. The domain presents a GoDaddy TLS Intermediate CA DV certificate (issued by GoDaddy.com), allowing it to serve content over HTTPS without browser warnings. An HTTP GET returns status code 200, confirming that a web server is actively responding. VirusTotal currently lists 4 of 95 security vendors as flagging the domain, indicating that detection is still emerging. The domain is labeled as a credential phishing campaign that mimics legitimate update prompts for a well‑known video‑conferencing platform.

Resolution data shows the domain points to IP address 13.248.213.45, an endpoint of AWS Global Accelerator located in Canada. Authoritative DNS is provided by ns61.domaincontrol.com and ns62.domaincontrol.com, both standard GoDaddy name servers. The site appears on three public blocklists – PhishDestroy, MetaMask, and SEAL – confirming that multiple threat‑intelligence feeds have observed malicious activity associated with this host. No additional IPs or CDN nodes have been identified, leaving the broader hosting footprint uncertain.

For defensive teams, immediate mitigation should include adding zoomupdate.info to URL filtering and blocking outbound connections to 13.248.213.45 at the network perimeter. Because the site uses a valid TLS certificate, organizations that employ SSL/TLS inspection should enable decryption for this domain to uncover credential harvesting forms. Continuous monitoring of reputation services such as VirusTotal is advised, as the number of vendor detections may increase. User education campaigns should reinforce verification of official update channels and discourage entry of credentials on unsolicited webpages.