zoomwithjudy[.]com

Analysis of the domain zoomwithjudy.com indicates a high-risk brand impersonation campaign targeting Google. The domain was registered on March 16, 2026, through Network Solutions, LLC, and currently resolves to the IP address 170.114.52.3. It has been flagged in 23 threat intelligence pulses on AlienVault OTX, suggesting widespread recognition as malicious infrastructure. Security vendors on VirusTotal have detected the domain as malicious, with 8 out of 95 engines marking it as unsafe. The domain appears on four security blocklists and is actively blocked by SEAL, MetaMask, PhishDestroy, and BLP-Malware, further confirming its classification as a threat. The page title, 'Join from App - Zoom,' does not align with the declared brand target of Google, creating uncertainty about the exact nature of the impersonation. While the domain is designed to mimic a legitimate service, the mismatch between the page title and the stated target may indicate either a broader phishing kit or an attempt to exploit multiple brands. The domain employs HSTS and HTTP/3, alongside Cloudflare for hosting, which are common techniques to evade detection and enhance perceived legitimacy. The SSL certificate is issued by Let's Encrypt, a neutral but frequently abused certificate authority in phishing operations. Defenders should treat this domain as an active threat. The infrastructure analysis reveals no legitimate use case, and the combination of technical indicators—such as the recent registration date, Cloudflare hosting, and security vendor detections—supports its classification as malicious. Organizations are advised to block the domain and its resolving IP at the network level. Monitoring for related domains registered through the same registrar or resolving to the same IP may help identify additional threats. Given the domain's presence on multiple blocklists, automated blocking via existing security controls is recommended to mitigate potential exposure.