securezoomservermeetingds[.]us

The domain securezoomservermeetingds.us was registered on February 21, 2026 through NameSilo, LLC and quickly surfaced as a credential‑phishing site targeting Zoom users, as indicated by its page title "Download Zoom". The site resolves to the IP address 89.163.155.33, which is associated with AS24961 WIIT AG in Germany. No TLS certificate is presented, meaning all traffic is unencrypted and vulnerable to interception. Nameserver records point to ns7.privatedns.vip and ns8.privatedns.vip, a pair commonly observed in malicious hosting configurations.

Security‑vendor scans on VirusTotal show 14 of 93 scanners flagging the domain, and the site appears on three external blocklists, confirming its malicious reputation. Defensive products such as PhishDestroy, MetaMask and SEAL have already blocked the domain. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the assessment of high risk. The site is currently offline, but the infrastructure components – the IP, nameservers and lack of SSL – remain observable and could be re‑used for future campaigns.

Defenders should continue to block the domain and its IP at perimeter and endpoint layers, monitor the associated nameservers for new domains, and consider adding the IP to threat‑intel feeds. Because the site is offline, there is limited visibility into any payloads or credential‑harvesting mechanisms, so further investigation of any captured traffic or logs from the brief active period would be valuable. Until the infrastructure is fully dismantled, organizations should remain vigilant for attempts to lure users with Zoom‑related download prompts and enforce multi‑factor authentication for Zoom accounts.