us06zoom[.]us

Analysis of the domain us06zoom.us indicates active brand impersonation targeting Zoom, classified as high-risk. The domain was registered on August 18, 2021, through ABOVE.COM PTY LTD and remains operational as of July 12, 2026. Infrastructure analysis reveals it resolves to IP address 199.191.50.190 and employs technologies including Nginx, OpenResty, Google Cloud, and Google Cloud CDN. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious sites. Threat intelligence sources confirm the domain appears on two security blocklists and is flagged in 24 AlienVault OTX pulses. Seven of 95 security vendors on VirusTotal detect the domain as malicious. The page title, 'us06zoom.us,' aligns with the observed brand impersonation pattern, though the exact content and functionality of the site have not been analyzed. No evidence suggests the use of a known phishing kit or additional malicious infrastructure beyond the current resolution. Defenders should treat this domain as actively malicious due to its long-standing registration, consistent brand impersonation, and multiple threat intelligence flags. Blocking at the DNS or network level is recommended, along with monitoring for related domains using similar naming conventions (e.g., 'usXXzoom.us'). Further investigation into the hosting provider and associated IP range may reveal additional malicious activity.