Investigate Zoom Bombings

A Zoom bombing occurs when unauthorized participants join a Zoom meeting to disrupt it — often by sharing inappropriate content, hate speech, or loud audio. Investigating these incidents requires correlating Zoom’s built-in telemetry with any available visual evidence.

Zoom Dashboard / QoS report

The Zoom Dashboard (available to admins) contains a Quality of Service (QoS) report for every meeting. This report includes per-participant device and network metadata:

• Device type — Desktop, mobile, tablet, or specific hardware model
• Microphone / Speaker / Camera — Detected device names (e.g., “Logitech G533”, “AirPods Pro”)
• IP address and location — Approximate geolocation and network type
• Join/leave times — Exact timestamps for each participant

Investigation workflow

1. Preserve the QoS report — Export or screenshot the dashboard data immediately after the incident.
2. Collect visual evidence — If participants recorded screenshots or video of the bombers, note visible hardware (headset make/model, background details, clothing).
3. Cross-reference — Match the visual hardware against the QoS report’s device fields. A distinctive headset or camera model can link a display name to a real device.
4. Check IP addresses — Look for patterns (VPNs, Tor exit nodes, residential ISPs). Zoom does not expose full IP addresses to regular participants, but admins can see them in the dashboard.
5. Review meeting settings — Determine whether the meeting required authentication, used a waiting room, or had a passcode. Bombers often exploit meetings shared publicly on social media.

Prevention

• Require Zoom authentication (SSO or account sign-in) for all meetings.
• Enable waiting room and admit participants manually.
• Use meeting passcodes and avoid posting links publicly.
• Lock the meeting once all expected participants have joined.

Related: osi-model (network layer evidence), confirm-gmail-address-existence (OSINT attribution).

Sources

• Zoom — Dashboard for meetings and webinars
• SFU — Protect your Zoom Meeting from Zoom-Bombing
• UCSB — Increase Your Zoom Security, Avoid and Report Zoombombing

See also

• osi-model
• confirm-gmail-address-existence