2zoommminviteee[.]com

Analysis of the domain 2zoommminviteee.com, observed as offline as of July 23, 2026, reveals infrastructure consistent with a Microsoft brand impersonation campaign. The domain was registered on October 9, 2025 through NameCheap, Inc., and is hosted on IP 104.225.130.131 belonging to AS395092 (Shock Hosting LLC) in the United States. Authoritative nameservers ns3.loominost.com, ns4.loominost.com, ns7.loominost.com, and ns8.loominost.com resolve the domain, indicating use of the loominost.com DNS infrastructure. No TLS certificate is presented, leaving the site accessible only via HTTP, which aligns with other low‑trust malicious deployments.

Reputation services show extreme distrust: Scamadviser assigns a trust score of 1/100, Gridinsoft reports 0/100, and the domain appears on a single security blocklist, currently blocked by PhishDestroy. VirusTotal scans have flagged the domain in 14 of 95 engines, confirming malicious classification by multiple vendors. AlienVault OTX references the domain in one threat‑intelligence pulse, providing additional corroboration of its malicious intent. The page title returned from the live endpoint, “Zoom Client Update,” is unrelated to the advertised Microsoft impersonation, suggesting a possible lure toward Zoom software updates while leveraging the Microsoft brand in other communications.

Because the site is offline, active investigation of its content is limited; the exact phishing kit or credential‑capture mechanisms remain unknown. Defenders should add 2zoommminviteee.com to blocklists at network perimeter and endpoint controls, monitor for DNS queries to the listed loominost.com name servers, and watch for outbound connections to 104.225.130.131. Email filtering should flag any messages referencing “Zoom Client Update” that claim to originate from Microsoft, and security teams should educate users about the lack of SSL and the low trust scores associated with this domain.