us16webzoom[.]us

Analysis as of July 24, 2026 confirms that the domain us16webzoom.us is actively used for brand impersonation targeting Telegram users. The site was registered through Dynadot LLC on December 18, 2025 and resolves to IP address 87.236.16.18, which belongs to Beget LLC (AS198610) located in Russia. Network infrastructure includes Nginx front‑end, Cloudflare CDN, and client‑side libraries such as Lodash, jQuery, FancyBox and cdnjs, indicating a typical phishing kit setup. The domain presents a TLS certificate issued by Let’s Encrypt (R12), providing encrypted connections despite malicious intent.

HTTP requests return a 403 status code, suggesting access restrictions that may be used to hide malicious content from casual browsers. The page title displayed is "The new site has been successfully created and is ready to work," a generic phrase that offers no legitimate context. Reputation data shows the domain appears on one security blocklist and is specifically blocked by PhishDestroy. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification.

VirusTotal analysis records 11 detections out of 95 scanned engines, providing independent confirmation of threat activity. Nameserver resolution is handled by ns1.beget.com, ns1.beget.pro, ns2.beget.com and ns2.beget.pro, all associated with the same hosting provider. Defenders should immediately add us16webzoom.us and its hosting IP 87.236.16.18 to URL filtering and firewall deny lists, monitor for related subdomains resolved by the same nameservers, and enforce endpoint protection that flags the observed detection signatures. Continuous re‑evaluation is advised, as the infrastructure may be leveraged for additional impersonation campaigns targeting Telegram or other messaging platforms.