secureconnect-zohomeet[.]net

This domain, secureconnect-zohomeet.net, is an active credential phishing site designed to harvest user login credentials by impersonating the legitimate Zoho Meeting platform. Visitors encounter a fraudulent login interface that closely mimics the authentic service, tricking users into entering sensitive account details such as usernames, passwords, and potentially multi-factor authentication codes. The stolen credentials are then transmitted to threat actors, who may use them for unauthorized access, financial fraud, or further targeted attacks against the victim or their organization. Analysis of the domain's infrastructure reveals several indicators of malicious intent. The domain was registered on June 25, 2026, through HOSTINGER operations, UAB, a registrar frequently associated with phishing campaigns due to its accessibility and low-cost registration options. It resolves to the IP address 82.29.199.64, which has no prior history of legitimate service hosting but is situated within a network range known for transient malicious activity. The SSL certificate is issued by Google Trust Services, a common tactic to lend an air of legitimacy to the site. Despite these red flags, the domain remains undetected by security vendors, with a VirusTotal detection score of 0 out of 95 engines as of the latest scan. If you or someone in your organization has visited secureconnect-zohomeet.net and entered login credentials, immediate action is required to mitigate potential damage. First, change the passwords for any accounts accessed through the site, prioritizing email, financial, and administrative accounts. Enable multi-factor authentication if not already active, using an authenticator app or hardware token rather than SMS-based methods. Monitor accounts for unauthorized activity, such as unfamiliar logins, sent emails, or changes to settings. Notify your organization's security team or IT administrator to assess potential exposure and implement additional safeguards, such as revoking active sessions or scanning for malware. Finally, report the domain to relevant authorities, such as the Anti-Phishing Working Group or your national cybersecurity center, to aid in broader takedown efforts.