us04web-zoom-us-j-9043562891[.]pages[.]dev

This domain is flagged as a high-risk phishing site specializing in brand impersonation, specifically targeting Zoom users. Analysis indicates the infrastructure is designed to mimic legitimate Zoom web services, likely to harvest credentials or distribute malicious payloads under the guise of a trusted platform. The domain's naming convention (us04web-zoom-us-j-9043562891) suggests an attempt to appear as an official Zoom subdomain or related service, a common tactic in phishing campaigns to exploit user trust in recognized brands. Infrastructure analysis reveals the domain was registered through Cloudflare, Inc. on September 02, 2020, and currently resolves to the IP address 172.66.44.124, associated with AS13335 (Cloudflare, Inc.) in the United States. Despite its age, the domain remains active and has evaded detection on major scanning platforms, with 0 out of 95 engines flagging it on VirusTotal. However, it appears on three security blocklists, including those maintained by reputable threat intelligence sources, indicating prior identification as malicious. The SSL certificate is issued by Google Trust Services (WE1), providing a false sense of security to potential victims. The page title 'Coming Soon' may be a placeholder or an attempt to mislead automated detection systems. Mitigation for this threat involves immediate blocking of the domain and its associated IP address (172.66.44.124) at the network perimeter. Organizations should update their email and web filtering rules to quarantine or reject any communications referencing this domain. End-users should be educated to scrutinize URLs carefully, particularly those claiming affiliation with Zoom or other trusted brands, and to verify the legitimacy of any unexpected login requests or download prompts. Given the domain's long-standing presence and use of Cloudflare's infrastructure, security teams should monitor for related subdomains or similar patterns in newly registered domains. If credentials were entered on this site, they should be reset immediately, and multi-factor authentication should be enforced to mitigate potential account compromise.