zoomconnectsession[.]live

Analysis of zoomconnectsession.live shows an active infrastructure that aligns with a high‑risk brand‑impersonation campaign targeting Zoom credentials. The domain was registered on 15 June 2026 through Tucows Domains Inc. and resolves to the AWS EC2 address 52.72.49.79 in the us‑east‑1 region, indicating use of cloud hosting. DNS is served by three systemdns.com name servers. An HTTP 302 response redirects visitors, and the site presents a TLS certificate issued by a public certificate authority, confirming encrypted connectivity. The page title returned is “Rebrandly”, which does not match the alleged Zoom brand and suggests a generic landing page. Reputation metrics are poor: Gridinsoft assigns a trust score of 0/100, and the domain appears on three security blocklists, having been blocked by multiple blocklist providers. VirusTotal records two detections out of 91 scanners, and AlienVault OTX lists the domain in two threat‑intel pulses. The observed indicators collectively support a credential‑phishing operation. Uncertainty remains regarding the exact phishing page content, as no visual analysis is available. Defenders should block the domain at the network perimeter, update URL filtering rules, and monitor for related IP or ASN activity. Incident response teams should treat any credential submissions to this domain as compromised and enforce credential resets for affected Zoom accounts.