candidatezoomcall[.]im

candidatezoomcall.im was observed hosting a page titled “Zoom Client Update” that purports to target Microsoft users. The domain was registered on 21 February 2026 and resolves to the IPv4 address 89.163.155.33, which belongs to AS24961 (WIIT AG) and is geolocated in Germany. TLS termination is provided by a Google Trust Services certificate issued to “WE1”, indicating the site leveraged Cloudflare’s SSL infrastructure. Network analysis shows the site employed Cloudflare services, including Browser Insights and HTTP/3, consistent with the observed technology fingerprint.

Reputation services flagged the domain: six of ninety‑three VirusTotal scanners raised detections, and the site appears on three external blocklists. It is currently listed as blocked by PhishDestroy, MetaMask, and SEAL, and the overall Gridinsoft trust score is 0 out of 100. The authoritative name servers are ns7.privatedns.vip and ns8.privatedns.vip, both duplicated in the record, a pattern often seen in malicious deployments. The primary malicious behavior is classified as brand impersonation of Microsoft, although the page title references Zoom, suggesting a possible lure combining multiple brand names.

The site is presently offline, limiting immediate observation, and no further content details have been captured. Defenders should add the IP address 89.163.155.33 and the domain to network blocklists, monitor for any re‑registration or similar sub‑domains, and enforce strict email filtering for messages referencing “Zoom Client Update” or Microsoft credential requests. Continuous telemetry from DNS and SSL logs is recommended to detect resurgence of the infrastructure.