Suspicious

Phishings targeting Zoom

Suspicious and active websites

Phishings targeting Zoom

Suspicious and active websites

Website
zoom.us
About
AIMeeting-software lure. Fake 'meeting recording' or 'calendar invite' pages typically route to Microsoft 365 or Google credential harvest pages.
Hosts
TIME-HOST LTD (34) · Cloudflare, Inc. (17) · Hawk Host Inc. (5)
Countries
RussiaRussia (34) · United StatesUnited States (24) · The NetherlandsThe Netherlands (2)
TLS certs
WE1 (6) · YE2 (4) · Let's Encrypt (4)
Historical record. phishunt is not tracking any active Zoom phishing site right now; the 75 entries below are from the 365-day archive (sites taken down, cleaned up, or otherwise inactive). Use them for retrospective analysis, not as a current threat-feed signal.
First seen URL IP Cert Detail
2026-10-28 http://us968web-zoom.us 172.67.75.57 WE1 Archived
2026-10-15 http://us03-web-zoom.us 104.21.48.148 YE2 Archived
2026-10-15 http://us06-web-zoom.us 104.21.60.22 YE2 Archived
2026-10-15 http://us07-web-zoom.us 104.21.22.13 YE2 Archived
2026-10-15 http://us02-web-zoom.us 188.114.96.3 YE2 Archived
2026-10-10 https://support.zoom.us.adelchan.multiskc.eu.cc 188.114.96.3 WE1 Archived
2026-10-04 http://schedule-meeting-zoom.us/join 104.21.33.3 YE1 Archived
2026-09-29 https://support.zoom.us.mamahputri.kasifa.de5.net 172.66.44.243 WE1 Archived
2026-09-29 https://8gpv-tszw-jyrx.phil-heron-zoomdrain-com-s-account.workers.dev… 188.114.97.3 YE1 Archived
2026-09-26 https://source.zoom.us.tedx.dpdns.org 188.114.97.3 WE1 Archived
2026-08-30 https://support.zoom.us.vip.kaisarstore.dpdns.org 188.114.96.3 WE1 Archived
2026-08-30 https://support.zoom.us.pro.kaisarstore.dpdns.org 188.114.97.3 WE1 Archived
2026-08-17 http://update50lite.net/zoom.us/windows/invite.php - - Archived
2026-08-17 http://invitee-io.com/zoom.us/windows/invite.php - - Archived
2026-08-17 http://web-zorm.com/zoom.us/windows/invite.php 91.195.240.123 - Archived
2026-08-17 http://08updatedlive.com/zoom.us/windows/invite.php - - Archived
2026-08-17 http://08liv3zorn-update3.com/zoom.space/windows/invite.php 198.252.106.250 - Archived
2026-08-17 http://06updatelive.xyz/zoom.us/windows/invite.php - - Archived
2026-08-17 http://web-meets.com/zoom.us/windows/invite.php 198.252.102.52 - Archived
2026-08-17 http://invitee-us.com/zoom.us/windows/invite.php 162.213.255.48 - Archived
2026-08-17 http://updatelivemeet.com/zoom.us/windows/invite.php - - Archived
2026-08-16 http://findmyapple-devices.co/script/zoom_map_2026_passcode6_login/co… 130.49.186.117 - Archived
2026-08-16 https://devicelocate.network/script/zoom_map_2026_passcode6_login/com… 130.49.186.117 - Archived
2026-08-16 http://lost-live.help/script/zoom_map_2026_passcode6_login/components… 130.49.186.117 - Archived
2026-08-16 http://lostdevice.co/script/zoom_map_2026_passcode6_login/components/… 130.49.186.117 - Archived
2026-08-16 http://lostapple-alert.live/script/zoom_map_2026_passcode6_login/comp… 130.49.186.117 - Archived
2026-08-16 http://supports-appie.com.tr/script/zoom_map_2026_passcode6_login/com… 130.49.186.117 - Archived
2026-08-16 http://apple.es-co.my/app/webroot/script/zoom_map_2026_passcode6_logi… 130.49.186.117 - Archived
2026-08-16 https://maps-apple.id/script/zoom_map_2026_passcode6_login/components… - - Archived
2026-08-16 http://findmydevice-locater.com/script/zoom_map_2026_passcode6_login/… 130.49.186.117 - Archived
2026-08-16 https://com-v.dev/script/zoom_map_2026_passcode6_login/components/2026 130.49.186.117 - Archived
2026-08-16 http://377618.click/script/zoom_map_2026_passcode6_login/components/2… 130.49.186.117 - Archived
2026-08-16 https://photos-shared.live/script/zoom_map_2026_passcode6_login/compo… 130.49.186.117 - Archived
2026-08-16 http://find-my-device.us/app/webroot/script/zoom_map_2026_passcode6_l… 130.49.186.117 - Archived
2026-08-16 http://apple-inc.com.tr/script/zoom_map_2026_passcode6_login/componen… 130.49.186.117 - Archived
2026-08-16 http://i-find.my/script/zoom_map_2026_passcode6_login/components/2026 130.49.186.117 - Archived
2026-08-16 https://soporteinfo.click/script/zoom_map_2026_passcode6_login/compon… 130.49.186.117 - Archived
2026-08-16 http://supports-location.help/script/zoom_map_2026_passcode6_login/co… 130.49.186.117 - Archived
2026-08-16 https://xiaomi-help.sbs/script/zoom_map_2026_passcode6_login/componen… 130.49.186.117 - Archived
2026-08-16 https://mail.iremoval.us/script/zoom_map_2026_passcode6_login/compone… 130.49.186.117 - Archived
2026-08-16 http://buscarmi.es-co.my/script/zoom_map_2026_passcode6_login/compone… 130.49.186.117 - Archived
2026-08-16 http://support-lost-alert.live/script/zoom_map_2026_passcode6_login/c… 130.49.186.117 - Archived
2026-08-16 https://soporte-info.click/script/zoom_map_2026_passcode6_login/compo… 130.49.186.117 - Archived
2026-08-16 https://apple-support-net.in/script/zoom_map_2026_passcode6_login/com… 130.49.186.117 - Archived
2026-08-16 https://lostdevice-live.help/script/zoom_map_2026_passcode6_login/com… 130.49.186.117 - Archived
2026-08-16 https://lcloud.ve-s.com/script/zoom_map_2026_passcode6_login/componen… 130.49.186.117 - Archived
2026-08-16 https://zu7pl.pro/script/zoom_map_2026_passcode6_login/components/2026 130.49.186.117 - Archived
2026-08-16 https://iremoval.us/script/zoom_map_2026_passcode6_login/components/2… 130.49.186.117 - Archived
2026-08-16 https://soporte.world/script/zoom_map_2026_passcode6_login/components… 130.49.186.117 - Archived
2026-08-16 https://support-lostdevice.live/script/zoom_map_2026_passcode6_login/… 130.49.186.117 - Archived

Showing the most recent 50 of 75 archived records.

AIHow to verify a real Zoom URL

  • Legitimate Zoom URLs always end in zoom.us (e.g. www.zoom.us, account.zoom.us). Anything else — including look-alike typosquats, hyphenated variations, or unfamiliar TLDs like .xyz / .top / .vip — is not Zoom.
  • The padlock icon proves TLS is active, not that the site is safe. Free DV certificates are issued to attackers in minutes; every active site listed above has a valid TLS certificate.
  • If you got the link from email, SMS, or social media, do not click it. Open zoom.us from your browser bookmark or type the domain manually.
  • Real Zoom pages almost never ask for credentials immediately after clicking from a message — treat any such redirect as a phishing attempt until the domain is verified.