zoommeeting2day[.]live

The domain zoommeeting2day.live was identified as a high-risk credential harvesting phishing site impersonating Zoom meeting services. This domain is currently offline but was previously active in targeting users of the Zoom platform to steal login credentials and other sensitive information. The threat type is classified as generic phishing with a focus on brand impersonation, specifically mimicking Zoom's official meeting infrastructure. Analysis indicates the domain was registered through NameSilo, LLC on February 21, 2026, and resolved to the IP address 104.225.128.78, hosted under AS395092 Shock Hosting LLC in the United States. The domain lacked an SSL certificate, increasing its risk profile for man-in-the-middle attacks or unencrypted data interception. Security vendors flagged zoommeeting2day.live in 20 out of 95 VirusTotal scans, and it appeared on three distinct security blocklists. The page title, 'Index of /', suggests an exposed directory listing, which is atypical for legitimate services and often indicative of misconfigured or malicious infrastructure. As of the latest assessment, the domain has been taken offline, reducing immediate risk to end users. However, the infrastructure remains a potential threat if reactivated. Organizations are advised to block the domain and its associated IP address (104.225.128.78) at the network level. Users who may have interacted with this domain should reset their credentials immediately, enable multi-factor authentication, and monitor accounts for unauthorized activity. Security teams should review logs for connections to the domain or IP and investigate any potential data exposure.