zoominvitemeetingsetup[.]vip

This domain, zoominvitemeetingsetup.vip, is identified as a brand impersonation threat targeting Zoom users. Analysis confirms it presents itself as a legitimate Zoom software download portal, specifically using the page title "Download Zoom" to deceive visitors. The domain is currently offline, but prior activity indicates a high-risk phishing operation designed to distribute malicious payloads under the guise of official Zoom installation files. Infrastructure analysis reveals the domain was registered on February 21, 2026, through NameSilo, LLC, and resolved to the IP address 89.163.155.33, located in Germany under AS24961 (WIIT AG). Security vendors detected the threat with 14 of 95 VirusTotal engines flagging the domain as malicious. It appears on three security blocklists and was proactively blocked by multiple threat intelligence platforms. Notably, the domain lacks an SSL certificate, a common red flag for phishing infrastructure. The absence of encryption further corroborates its fraudulent nature. The domain has since been taken offline, likely due to enforcement actions or hosting provider intervention. However, users who may have interacted with it should assume potential compromise. Organizations are advised to block the domain and its associated IP (89.163.155.33) at the network level, revoke any credentials entered on the site, and scan affected systems for malware. Security teams should monitor for similar domains registered through NameSilo or resolving to the same IP range, as threat actors often reuse infrastructure across campaigns.