zoommeetinglink[.]com

Analysis of zoommeetinglink.com shows an active high‑risk phishing infrastructure. The domain was registered on February 21, 2026 through One.com A/S, a Danish registrar that also provides the hosting environment. DNS resolution points to IP 46.30.215.162, which belongs to AS51468 One.com A/S in Denmark. The web server returns HTTP 200 and presents the generic page title "Hosted By One.com | Webhosting made simple," indicating that no targeted brand or login portal has been identified on the landing page.

The site is protected by a Let's Encrypt certificate (issuer E7) and runs Varnish in front of an Apache HTTP Server, typical of standard shared‑hosting stacks. Threat intelligence sources flag the domain: six of ninety‑three VirusTotal scanners have raised alerts, AlienVault OTX includes it in one pulse, and three independent blocklists have added it. It is also blocked by PhishDestroy, MetaMask, and SEAL. Reputation scoring from Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious assessment.

Nameservers ns01.one.com and ns02.one.com confirm the One.com hosting relationship. While the exact phishing lure (e.g., Zoom credential harvesting) has not been publicly disclosed, the combination of recent registration, low trust score, multiple vendor detections, and active blocklist listings suggests a coordinated credential‑stealing campaign. Defenders should block network traffic to 46.30.215.162, add zoommeetinglink.com to URL filtering and email security policies, and monitor for any related indicators of compromise. Continuous re‑evaluation is advised, as additional payload or lure details may emerge in future observations.