zoommeetingsetup[.]info

This domain is assessed as an elevated-risk brand_impersonation threat targeting Zoom. Analysis indicates that the infrastructure was likely intended to leverage a trusted brand identity to attract user interaction and potentially facilitate credential collection or other forms of user deception. Although the domain is currently offline and has been taken offline, historical indicators remain relevant because brand-impersonation infrastructure is frequently reused, replicated, or referenced in future campaigns. The observed page title was "Index of /", which does not provide legitimate branding validation and may indicate a misconfigured or previously active hosting environment.

Infrastructure analysis reveals that zoommeetingsetup.info resolved to IP address 89.163.155.33, located in DE under AS24961 WIIT AG. Registration records show the domain was created on November 12, 2025, and registered through NameSilo, LLC. Certificate telemetry identified an SSL certificate associated with PhishDestroy / botadmin.destroy.tools. Security reputation data indicates the domain appears on 1 security blocklist and is specifically blocked by PhishDestroy. Detection statistics show that 18 out of 95 security vendors on VirusTotal flag the domain. The combination of brand targeting, security detections, blocklist inclusion, and takedown status supports classification as potentially malicious brand-impersonation infrastructure.

Users who accessed this domain should review any actions performed during the visit, particularly the submission of credentials, authentication tokens, personal information, or downloadable content. If credentials were entered, they should be changed immediately through the legitimate service, and associated accounts should be reviewed for unauthorized access. Security teams should search network, DNS, proxy, and endpoint logs for connections to zoommeetingsetup.info and IP address 89.163.155.33, maintain blocking controls, and investigate any related indicators of compromise. Continued monitoring for similar lookalike domains, certificate overlaps, and infrastructure reuse is recommended to reduce exposure to future brand-impersonation attempts.