usweb03zoominvite[.]com

Analysis of the domain usweb03zoominvite.com shows a newly registered infrastructure that targets the Zoom brand through brand impersonation. The domain was created on October 09, 2025 and is hosted on the IP address 176.123.0.55, which resolves to Maryland under autonomous system AS200019 owned by ALEXHOST SRL. No SSL certificate is presented for the host, indicating an unencrypted HTTP service. The site’s page title, "Join Meeting | Zoom," directly mirrors a legitimate Zoom meeting URL, confirming the intended brand lure. The domain appears on one security blocklist and has been actively blocked by the PhishDestroy service, suggesting that at least one defensive feed has identified it as malicious.

VirusTotal scanning reports that 5 out of 95 security vendors have flagged the domain, providing modest but corroborating detection evidence. Gridinsoft’s trust scoring system assigns a zero rating out of 100, reinforcing the low reputation of the host. Registration details list Hosting Concepts B.V. operating as Registrar.eu as the registrar, while the authoritative name servers are ns3.alexhost.md and ns4.alexhost.md, both consistent with the hosting provider. Current operational status is offline, which may be the result of takedown actions or temporary suspension.

Uncertainty remains regarding the full scope of the campaign, such as the presence of additional payloads, the exact phishing kit employed, or the volume of victims contacted, because no further forensic artifacts have been disclosed. Defenders should update URL filtering and blocklist rules to include usweb03zoominvite.com, enforce TLS inspection to detect the lack of encryption, and monitor traffic to the associated IP 176.123.0.55 for any residual activity. Organizations using Zoom should educate users about unexpected meeting invitations and verify URLs against official Zoom domains.