us01web-zoom-us-j-4546890215[.]pages[.]dev

Analysis of us01web-zoom-us-j-4546890215.pages.dev indicates a brand‑impersonation infrastructure targeting Zoom users. The domain was registered through Cloudflare, Inc. on September 02, 2020 and currently resolves to the Cloudflare‑owned IP address 172.66.44.135, which is associated with AS13335 in the United States. DNS resolution is handled by four Cloudflare name servers: adi.ns.cloudflare.com, karl.ns.cloudflare.com, mallory.ns.cloudflare.com, and nico.ns.c. The site presents an HTTP 200 response and serves a page titled "Coming Soon"; no additional content has been observed.

TLS termination is provided by a Google Trust Services certificate identified as WE1, and the server advertises HSTS and HTTP/3, confirming the use of modern security features supplied by the CDN. Security telemetry shows the domain appears on a single blocklist and has been flagged by PhishDestroy, reinforcing its malicious classification. A Gridinsoft trust score of 0 out of 100 further denotes a high‑risk profile. VirusTotal records indicate that 93 scanning engines have examined the domain, with no current detections, though the absence of alerts does not constitute safety assurance.

Defenders should treat the domain as malicious, enforce blocking at the DNS or proxy level, and consider adding the associated IP address to deny lists given its association with known phishing activity. Continuous monitoring of the IP range and related Cloudflare name servers is advised, as the infrastructure could be repurposed for additional impersonation campaigns. Since the site is currently offline, any future reappearance should trigger immediate scrutiny, especially if the page title or content changes to more directly mimic Zoom login interfaces.