2meet[.]click

The domain 2meet.click is currently active and classified as a high‑risk generic phishing site. Technical analysis shows that it resolves to the IPv4 address 209.182.224.47, which is hosted by Shock Hosting LLC in the United States. The server presents a Let’s Encrypt TLS certificate (YR2) and responds to HTTP requests with a 302 redirect, ultimately delivering a page titled “Account Suspended.” Registration data indicates the domain was created through NameSilo, LLC, and it is served by the authoritative nameservers ns4.loominost.com and ns3.loominost.com. An MX record is present with priority 0 pointing to 2meet.click, suggesting potential email use for credential harvesting. Reputation services have flagged the domain: six of ninety‑one VirusTotal scanners reported malicious activity, and the domain appears on three external blocklists. It is already blocked by PhishDestroy, MetaMask, and SEAL. While the exact phishing payload or targeted brand is not disclosed, the observed infrastructure and detection history confirm malicious intent. Defenders should add 2meet.click and its associated IP address to network deny lists, monitor DNS queries for the domain and its nameservers, and consider sinkholing the IP to disrupt any ongoing campaign. Ongoing surveillance is advised to capture any changes in hosting, certificate renewal, or additional payload deployment.