https://zoom.mofassel.com/

Impersonating Zoom

Intent: Persuasion

• Domain name closely resembles Zoom's real domain
• TLS certificate has no organization information
• Domain is not operated by Zoom
• Domain not registered through Zoom's usual registrar
• TLS certificate was issued very recently
• SPF record does not reference Zoom's infrastructure

page with a prominent call-to-action button urging user to connect or proceed