zooom2daymeettings[.]live

This domain, zooom2daymeettings.live, is identified as a credential theft operation designed to harvest user login credentials through deceptive login portals. Analysis indicates the site mimics legitimate meeting or collaboration platforms, tricking users into submitting sensitive information such as usernames, passwords, or multi-factor authentication codes. The infrastructure is engineered to exfiltrate data to attacker-controlled servers, enabling unauthorized account access and potential follow-on attacks, including identity theft or corporate espionage. Infrastructure analysis reveals multiple high-confidence indicators of malicious activity. The domain resolves to the IP address 104.225.130.131 and was registered on March 05, 2026, through NameSilo, LLC, a registrar frequently associated with abusive domains. Security vendors on VirusTotal flag the domain at a ratio of 18/95, while Gridinsoft assigns a trust score of 0/100. The domain appears on four security blocklists and is actively blocked by multiple threat intelligence platforms. Technologies detected include LiteSpeed and HTTP/3, which are often leveraged to evade detection and accelerate data exfiltration. Users who visited zooom2daymeettings.live or entered credentials on the site should take immediate action to mitigate risk. First, revoke any active sessions on the affected account and change passwords for all accounts where the same credentials were reused. Enable multi-factor authentication using app-based or hardware tokens, avoiding SMS-based methods. Monitor financial and communication accounts for unauthorized activity, and report the incident to relevant security teams or fraud reporting channels. If corporate credentials were exposed, notify internal IT or security operations to initiate incident response protocols.