zoominviteweb[.]com

The domain zoominviteweb.com is currently active and was registered on February 23, 2026 through the Hostinger Operations, UAB registrar. It resolves to the IP address 216.198.79.1, which is owned by Amazon.com, Inc. (AS16509) and geolocated to the United States. The site is hosted on the Vercel platform and presents an HSTS header, indicating that it enforces HTTPS connections. The TLS certificate is issued by Let’s Encrypt (R12), confirming the use of a valid, publicly trusted certificate. An HTTP 307 temporary redirect response is observed, which may be used to forward victims to additional malicious pages.

The page title returned by the server is "Joining Meeting… | Zoom," signalling an attempt to impersonate a Zoom meeting invitation. VirusTotal analysis shows that 4 of 93 security vendors have flagged the domain, suggesting a moderate level of detection across the security community. The domain appears on three external blocklists and is explicitly blocked by PhishDestroy, MetaMask, and SEAL, reinforcing its classification as a phishing vector. Gridinsoft assigns a trust score of 0 out of 100, indicating a high likelihood of malicious intent.

Nameservers are set to ns1.dns-parking.com and ns2.dns-parking.com, which are commonly used for parked or short‑lived domains. While the available data confirms the infrastructure and initial detection, details about the specific payload, credential‑harvesting forms, or post‑compromise activity remain unknown. Defenders should consider adding zoominviteweb.com to URL filtering and DNS block policies, monitor outbound connections to 216.198.79.1, and enforce strict email authentication to reduce the risk of delivery. Continuous threat‑intel feeds should be consulted for any emerging indicators of compromise related to this domain, and any internal incidents that involve Zoom meeting links should be examined for potential exposure to this phishing infrastructure.