us08webzooms[.]live

This domain, us08webzooms.live, is actively impersonating Zoom, as indicated by its classification as a brand_impersonation threat and the presence of the page title 'Проверка доступа' (Access Verification in Russian). Registered on October 28, 2025, through PDR Ltd. d/b/a PublicDomainRegistry.com, the domain remains operational as of July 12, 2026, resolving to the IP address 144.124.237.40. Infrastructure analysis reveals the use of PHP and Nginx, alongside reCAPTCHA integration, which may be employed to evade automated detection or add a veneer of legitimacy. The SSL certificate is issued by Let's Encrypt, a common choice for both legitimate and malicious domains due to its free and automated issuance process. The domain has been flagged in 23 threat intelligence pulses on AlienVault OTX and appears on two security blocklists, including PhishDestroy and BLP-Malware. Gridinsoft assigns it a trust score of 0/100, further corroborating its malicious classification. While eight of 95 security vendors on VirusTotal have flagged the domain, the absence of detections from the remaining vendors does not imply safety, as detection rates for newly registered or actively evading domains often lag. Defenders should treat this domain as high-risk due to its active status, brand impersonation, and inclusion in multiple threat intelligence feeds. The Russian-language page title suggests targeting of Russian-speaking users, though the exact scope of the campaign remains unconfirmed. Network-level blocking of the domain and its associated IP (144.124.237.40) is recommended to mitigate potential credential harvesting or malware distribution. Further analysis of the domain's content and backend infrastructure is advised to determine the full extent of its malicious capabilities.