zoommeetlink[.]us

Analysis of zoommeetlink.us shows a newly registered domain created on February 27, 2026 and hosted on IP address 104.225.128.78, which belongs to AS395092 Shock Hosting LLC in the United States. The domain resolves to that single address and is served without an SSL certificate, indicating an absence of encrypted transport. Registration was performed through NameSilo, LLC and the authoritative name servers are listed as ns3.loominost.com and ns4.loominost.com. The page title returned from the live endpoint is "Zoom Meeting | Secure Video Conference," suggesting an attempt to impersonate a legitimate video‑conference service.

The site has been added to three public blocklists and is currently listed as blocked by PhishDestroy, MetaMask, and SEAL. VirusTotal scanning shows that one out of ninety‑three security vendors flagged the domain, confirming at least one independent detection. The domain’s status is reported as offline, which limits further real‑time observation, but the historical evidence points to a short‑lived phishing campaign targeting Zoom users. Uncertainty remains around the specific phishing kit or payload, as no additional payload hashes, redirect chains, or credential‑stealing forms have been disclosed.

Defenders should continue to block the domain at network perimeter controls, update DNS filtering with the known blocklists, and monitor for any resurgence of the same IP or name‑server configuration. Because the site lacks TLS, any attempt to access it would be over clear‑text HTTP, providing an additional mitigation surface. Threat‑intel teams should flag the domain in internal watchlists and correlate any future Zoom‑related credential‑theft alerts with this indicator to reduce exposure.